0x7f0000000080)='./file0\x00', 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x10000, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000100)={0x0, 0x7ffe, 0x20, 0x3, 0x9}, &(0x7f0000000400)=0xffffff66) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000180)={r1, @in={{0x2, 0x4e23, @broadcast=0xffffffff}}, 0x1, 0x9f03}, 0x90) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x100, 0x0) getsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f0000000540)=""/236, &(0x7f00000003c0)=0xec) pwrite64(r0, &(0x7f0000000440)="e7fe3aece7ef9c7d69d723ca60ddebbd8021532eabc137d6f762ee05475290b50412ffe9b365b21b4e9dc3a2aa8e28f8abba1a0dcd63341a9a454641e19b5968f0c377306eef70e04d501b400b77b129c576b28464b82262d0495fc94d6e4baf103ab440932cbd676bdf112f27694111eee6c8fb830a9937e4c60835c865f04bf592866590f15a28d0aaa89bb206a9041f3bd9fc9f492ba7a54537c60e0d9cf5a0387b15387016429280f0e9799ba439953c1c43458980910d108812dd81e8be9f0a326ab30a", 0x469, 0x0) write$binfmt_script(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="2321202e2f66696c6530206d696d655f747970652e5e5d2a2047504c23656d312f706f7369785f61636c5f616363657373202f6465762f6e756c6c00202f6465762f7161745f6164665f63746c00202f6465762f7161745f6164665f63746c00202f6465762f7161745f6164665f63746c0020776c616e3040292c0a56e2e27221255b5a1e37d47887ab7a9d87b2d0552be5ab2dd4d4e34da4b68e0dadb362b6611944dab1b59affc04b121c4663c1ca33deec8e332361c0df42c9ed2dbafd5a167b686b308d85ea30253510a673581f91753ff6150be9138b688fe5dfbbf90c1c13cc0673c91c48e4c5a2871e7739f0cedebb1b561a38ea1960907d9e5171656bce9962a760e028f3c7ca9526c0a23692aa6b2ec3ecfca923a090bbc6bd624bcdf45eda2c6e76fcdd9505111e03da73ee03a3e43febe30dbfa48cd3f4e388bf282ed432fcf1836ef67fdd110f6523d3912c27032265e6c135a8"], 0x15a) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000040)=0x1c, 0x4) 03:00:38 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) [ 136.934191] binder: send failed reply for transaction 105, target dead 03:00:38 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x8000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:38 executing program 6: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) socket$inet6(0xa, 0x1, 0x9) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') r0 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x4000000, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000080)=0xffffffffffffc274) 03:00:38 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0xa00, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 136.991623] binder: release 10594:10595 transaction 109 out, still active [ 136.998617] binder: unexpected work type, 4, not freed [ 137.003936] binder: undelivered TRANSACTION_COMPLETE [ 137.008878] binder: invalid inc weak node for 110 [ 137.013913] binder: 10594:10595 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:38 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x37, &(0x7f0000000200)={@empty, r1}, 0x14) 03:00:38 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000000c0)=0x0) ptrace$setopts(0x4200, r1, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00005befdc)) r3 = syz_open_pts(r2, 0x4000) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000000000)={0xec, 0x0, 0x7}) fcntl$getownex(r2, 0x10, &(0x7f0000000040)={0x0, 0x0}) ptrace$setopts(0x4200, r4, 0x8, 0x40) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000100)={0x3, 0xffffffffffffff9c}) write(r3, &(0x7f0000000000), 0x0) 03:00:38 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:00:38 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x9000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:38 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xffffff7f, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:38 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x800, 0x0) ioctl$KDSETLED(r0, 0x4b32, 0x1) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:38 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x0, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:38 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x7c) chroot(&(0x7f0000000280)='./file0\x00') mq_getsetattr(0xffffffffffffffff, &(0x7f0000000000)={0x9b, 0xa4, 0x10c0, 0x3, 0x7ff0000, 0x2, 0x1, 0x8}, &(0x7f0000000040)) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f00000001c0)={0x28, 0x0, 0xffffffff, @hyper}, 0x10, 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') r1 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x7, 0x4000) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f00000002c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="480000002ee0b5a41a3cd545f14153df3247bc6b64ae617b0b21daccffdd902fc6e4c08bb11f9670ca28510f3bbe19b5fff6c999eed2d106933ae8cdd2663fe298b141e9fd6ea5d94b05da76"], &(0x7f0000000240)=0x50) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000380)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000340)={r2}, 0x8) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000200)) ioctl$TIOCGPTPEER(r1, 0x5441, 0x1) mount(&(0x7f00000003c0)='./file1\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000500)='bfs\x00', 0x8000, &(0x7f0000000540)="bab8a98e64b8698e22e5dc86cdfcf5f8342c613d26c9b6d529b9e3583ba7b52b1e7b504a94e09051d0c04c97037006faa4a9b54ea6c0f50c2d9043a6d52f595d9b4236774b8372ad840f62fa39e89af8676c15f45bd8fc28ea01ce89b0915c6569ac789545c296378cbf71c5c3d09f94920924098ec788dcd8b3689830a8d1442b2f4378acf3be2964be06859261de36dde54d4d07a4a4afee9fcc8898f1b36d0c5586b060036715f571c8126d1998cb32e03074b9d82df70c27cb18a5c98872e8cb578531e6ec31450d600cbbb8fb2faf069c8fe3ebfc538dc762ec408ac04437577e0b7040ec963626fa7d1716782e93") mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100)={0x100, 0x1000, 0x5, 0x2, 0x81, 0xffffffffffffffe0, 0xfffffffffffffe00, 0x5}, &(0x7f0000000140)) ioctl$EVIOCGABS20(r1, 0x80184560, &(0x7f0000000640)=""/43) 03:00:38 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x17, &(0x7f0000000200)={@empty, r1}, 0x14) 03:00:38 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:00:38 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x100) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) [ 137.181238] binder: send failed reply for transaction 109, target dead 03:00:38 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x97ffffff, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:38 executing program 0: mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x3) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:38 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x6d8, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:38 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x2a, &(0x7f0000000200)={@empty, r1}, 0x14) [ 137.277168] binder: release 10649:10651 transaction 113 out, still active [ 137.284179] binder: unexpected work type, 4, not freed [ 137.289482] binder: undelivered TRANSACTION_COMPLETE [ 137.296133] binder: invalid inc weak node for 114 [ 137.301068] binder: 10649:10651 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:38 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:00:38 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) r3 = dup3(r1, r0, 0x80000) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r3, 0xc0145401, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x4, 0x1, 0x8}) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) 03:00:38 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xe000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:38 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:38 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f00000000c0)='./file0/file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') 03:00:38 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xd8, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 137.377617] binder: send failed reply for transaction 113, target dead 03:00:38 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:00:38 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x13, &(0x7f0000000200)={@empty, r1}, 0x14) 03:00:38 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) ioctl$KVM_SET_PIT(r0, 0x8048ae66, &(0x7f00000000c0)={[{0x3ff, 0x7, 0x81, 0x7, 0x0, 0x2, 0x78d, 0x5, 0x10001, 0x8, 0x5, 0x9, 0x80000001}, {0xa00000000000000, 0x8, 0x2, 0x4, 0x101, 0x4, 0x6, 0x1, 0x100, 0xd28, 0x9, 0xb7b, 0x1000}, {0x35f, 0x2, 0x2, 0xa00000000000, 0x7, 0x10000, 0x25, 0xfffffffffffffffe, 0x7ff, 0x9, 0x74ad, 0x59, 0x8}], 0x9}) 03:00:38 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) [ 137.454097] binder: release 10686:10691 transaction 117 out, still active [ 137.461093] binder: unexpected work type, 4, not freed [ 137.466393] binder: undelivered TRANSACTION_COMPLETE [ 137.471992] binder: invalid inc weak node for 118 [ 137.476976] binder: 10686:10691 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:38 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1003, &(0x7f0000000200)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000200)=0x0) r2 = getpgid(0xffffffffffffffff) r3 = syz_open_dev$mice(&(0x7f0000000240)='/dev/input/mice\x00', 0x0, 0x101200) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f00000002c0)={r3, r0, 0x5}) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="5400000025e502d30c6becbf6af5aa764f295178f91647f8f716c39cf70be616ca27e64479944eb21eaf4c899db074427b0b0e0f3cbcc3de66a91b2e92cd9aced63cb06c43a08d29644b276b6ddb70a42962c0445ad4f46a25fca987ae6a716d23a31e9cdc0aff0991c29beb3424820664543ddfef58cd82a769b9643176d75c0a932c4a382637dff013fd0c176077c62a4c337c488d50897956ccd15a8f46e45877405589dd2d6774", @ANYRES16=r4, @ANYBLOB="10082dbd7000fddbdf250205eece27b75597980004000300000008000500000000001400020062707130000000000000000000000000080008000100000008000500d00000000800040002000000"], 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x80) 03:00:38 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xffffffc0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:38 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x3c, &(0x7f0000000200)={@empty, r1}, 0x14) 03:00:38 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000001600)='\x00', 0x400, 0x100) socketpair(0xe, 0x7, 0x9, &(0x7f0000001700)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = memfd_create(&(0x7f0000001800)='btrfs\x00', 0x2) r3 = syz_fuse_mount(&(0x7f0000001840)='./file0\x00', 0xa000, 0xffffffffffffffff, 0xffffffffffffffff, 0x1d5e, 0x140000) r4 = epoll_create(0x9) r5 = syz_open_dev$adsp(&(0x7f0000001e80)='/dev/adsp#\x00', 0x7fffffff, 0x40001) r6 = mq_open(&(0x7f0000001ec0)='{\x00', 0x1, 0x40, &(0x7f0000001f00)={0x7, 0x100000001, 0x5d80, 0x3ff, 0x80, 0x5, 0x3, 0x7}) r7 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000001f40), 0x4) r8 = signalfd4(0xffffffffffffffff, &(0x7f0000001f80)={0xb2}, 0x8, 0x800) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000002000)={&(0x7f0000001fc0)='fuse.'}, 0x10) sendmsg$netlink(r0, &(0x7f0000002080)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000001640)={0xb0, 0x29, 0x12, 0x70bd2b, 0x25dfdbfe, "", [@generic="1d6cb46e07ff0614b7404353d95df7343ce3b38be3417b41cf38ac75b15986e1fd3168a9fb23b0119c00c262d62438929289025b7d54190a6305b6b817b94b6a5b038e018697ae7e508b4eb7bb202ea8351aaa7f45749993e6f52a6ad02e53953285fa9099a6158daba52aa382162c618089da03e19955442bb15ee085f8179b0db08b4501f72e65b1b0657b1cdf4acb426c18fb4ecb7b9e693844bb08e625"]}, 0xb0}, {&(0x7f0000001b00)={0x1d4, 0x35, 0x800, 0x70bd2b, 0x25dfdbfd, "", [@typed={0x8, 0x1e, @u32=0xc339}, @nested={0x1a8, 0x34, [@generic="5a3c9a1f3bbe2201959ffa501c75fa15a763ece18c8eaff820bfbc130187c58f3335446ab8367bd108d6635de492c1ddd652066e2a3e1f4ba599e5815575cedf44b50c12f827e5eb351317fe1ba8b72d40125524b403bab35f73604ff3a4ae2b5509f6c8dadb04f0f746ca2001c92a004f0cc78f6d1781b086c11ca25717d3942fbaf1c43e27c7a61b34a3ce65c9c910a8a5215f487e1a1010beea63e20c90fa", @generic="de24c58560e65ea52f3674ebec4ef68bdf6c6489ad72f43e673eb7f12f74e84872fb5510706530bd3d319a5750c6a4f8aff07660f564faeb8850131d1f53f2a7e61238fa27344380c5e98242e82383935fc072675c6bdcd2953f2fa26b4456b5a21f80b33b67edd57400e342362acfde3112ab886b89494158c59e3c7441f0cc4e61b77f667d2c3ebacb2ffb9c425a538396778292114dd065d938666f508dea5346e068aa037703c75871f4dbe8d141b10329085c93547efc2b0e9a4a77a6910bcf3ae68f444b97c364267fad6fd6b0929d035beda2dae563de3ed72264aaea7b33b2b69e1d3b2f23a25d2c8ad5720e", @typed={0x14, 0x45, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}]}, @typed={0x14, 0x4b, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}]}, 0x1d4}, {&(0x7f0000001d00)={0x180, 0x29, 0x400, 0x70bd29, 0x25dfdbfb, "", [@nested={0x170, 0x62, [@generic="41bbc2a003922afd458b10b003b1cb2e3d45f00fc8dd440b937a5e8b842e65a1c9c57d952afd3e9a7ab00e46625f3ec66d9a82641957", @typed={0x8, 0x72, @ipv4}, @typed={0x28, 0x4, @binary="3f7b81ac6f6e8ae7183809c5f92601d853fe1e820037c65885004184527c9fca50ebe5"}, @typed={0x8, 0x22, @fd=r1}, @generic="124e1783f17d6f262b9efb8da59b72252341ad63881e997e33074e015f984b2ab5b3e2b34068c818d464c30538c9f6a01cae756a1815ba53fd5c3803bc8599703d703fe18507f306229117a1cedb2fc70e4aac9e7acfd67382bf8ba1c85c8a35be7336f1bfb3a2064e4f5eb409bbebae51ce5bb9951cba1a6855a5cda34ddcd18265fcad87de2b59d0197a2ede15cc7bdcd7e2664f5747f7541b5165c26d90bf5fd53fb55cbaef839e80d9553e7dd64b2b15642562d17de18580694b5e618b7e9d093c641ccc2892dab22666bc1bbe96cc4750671d7b5d782d6dbfe5ae52ec711e7175a71dd8917f2775c7d342884d92d40835da8ffbec7286c8e8"]}]}, 0x180}], 0x3, &(0x7f0000002040)=[@rights={0x30, 0x1, 0x1, [r2, r3, r4, r5, r6, r7, r8, r9]}], 0x30, 0x1}, 0x40085) mkdir(&(0x7f0000000080)='./file0\x00', 0x1000) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f00000020c0)) r10 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, &(0x7f00000000c0)=0x80, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000000100)={0x0, 0xf87}, &(0x7f0000000140)=0xc) setsockopt$bt_BT_RCVMTU(r11, 0x112, 0xd, &(0x7f00000015c0)=0x8, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r10, 0x84, 0x18, &(0x7f0000000180)={r12, 0xffff}, 0x8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r11, 0x84, 0x18, &(0x7f0000001780)={r12, 0x7ff}, &(0x7f00000017c0)=0x8) mount(&(0x7f0000005000)='./file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) syz_open_dev$usbmon(&(0x7f0000002100)='/dev/usbmon#\x00', 0x4, 0x309000) syz_mount_image$btrfs(&(0x7f00000001c0)='btrfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x5, &(0x7f0000001540)=[{&(0x7f0000000240)="ca85442bc441418b0f24255538b610560ffbd2174cea36397150eb4e5a4fc8ace03c68b02e9b06b145c3359ee87e10c3a97bfc41cc9fcd78ea58fd60d54f91832c37a0393d75bff37dc96499ea0cc61d8cc08a84cec8c3e1f9cf775f4cd07825dd4d7145f2fba1462eb12fbba287ba78afe3e601dde2cfd4501f084629f7cfca1bf1a7891c2e0c692dd2787189dfb7712da9153a5a844709257da7ea1a2a80470ed1e92aa0805d87", 0xa8}, {&(0x7f0000000300)="a9e66b6ffc72cd8b4639fe32314ceac1ea75b1dfafe73edda8150325d057a1ef74942a7cce4962d621a35a53a63004a3103dfe4780b257cb7fba5c3b9b4c7b216b24016534abfa0b522ac395a4c630ac826f64056b1c2f603ec73443a363479e7bf75ce14b366d77e2d4f828cdd99442cbcf0c8d91bd578fc83fe1e50ac20bda277a113240b790eeefd5dd201da2cef590fb3def8956b8028ae4128618149e5ab956e91431f44d0e868a02569aaf78b396d7bf7ed8641494e1f43cd2ebd012eec7a20224ec276ce847595eb9cda7589c14ed902afeff70df933703d2393c8192eb1c51f49f9faabd397062f823218f478a4e08eaad48d67bdbe0", 0xfa, 0x652}, {&(0x7f0000000400)="322a06294cc3e96143929210338fefd847cd229e01f25341b744dbc9facf5d966e0a00c583bb6446db7d122199b0b3e4f9408106d9ccba1746cd8ee7cb20f180cae8b41b9e4200d843adb5d1ae80d25a464fd410498e328e411493be3f57d9e83dc102ac8f6d5fb4e50323bff43adfd8901f07060d65da8767d1e7f284b60749b5a03b1e85769fb43d6fc79b2fe27a1a3cd1141d62a45a6b13bae9aeb73de57880aacc779b37c6df01c4bb100284dc2e3ff636", 0xb3, 0x1ff}, {&(0x7f00000004c0)="8909a5d29196244f4acd534527214520db9ba8de6ad41bc3729a8d1c9458b525685fbd698d6bcb9f3d587e8f00320e8b12161754f12ddc1469b0b73ac7910e2e5564160f926e7b119a5cd4b0663aab1a1879e87206f92525a76f7a75191ce51a4c89e273d6", 0x65, 0x5}, {&(0x7f0000000540)="125c87e13cab9316c1051f8b390c2fb18dddb7655cc993c759c91f53c4c90ffe4a610260f70e2fdaf2dbab6a6911a23741e6dd49a75eb819f0cfcd13db1a4a48c163da2cd57d34f13689d07c9fabc192932f0c87f398531eb6ae22f3f628aa67b880b86c75f82f83fe88fc0d6cbad9e2b23a00b99132bf3148afc636dd6648253aff3143676b1e1c425195b00b0b3ecf7b6a42486237075f652765ac6d186393be7c01401531591632634fedb4188aae384fea2d204856acda1e22640ab24877ad393626aab6639dacf3e324ce2a226a05a815d1684569002b86e67beb9bf3b20ed5760ac1c42d2394e8f6830ff28f99a79b374d99e1bb7c0d5f2e660d6d01ce3343c075812f391a0d72d54a05432977244b98087327c7e50a60a4c948737d91a9b1ff47ace6189bb10711f6cea0a9fed9a8aba2b40333c48e2505b194b5d58c9884796f59daeea8f1389df0b2dc0d9e8979a8b6f5d04c9187a593d042226626d86ead1fa98c480703afefa3f9cff4647fff4d465341192103c871b0280afcdabaf5e7b68a3fb3928b8efe9a4726f47bb47c13c402a7c3f7058012975c9a799d84606e66085771e737f5466cb37a7d3d1a264ee8339ae7605fe8048a0b398e296376beb1c84f2ad0c717f036826c57a3e2c0f420d462f349152d9db09b6961e94a066cd0e26ac9452e6b7c1c0a8531a2dabaa7db93cb69ffb52b0d46cddd46d4c0c9e1582835899ae6e17af1d8a7fa1d638bf8e6dee1eca2a7783d75885dc2b9785659241b8a3e1bd6383db933f92ab8593abf2d9d11fd282d208222902b745a641454c5bb2deba5cb874a2a5904304ba5b56a93bbe2bd617ecb5d4ce2262e1ffa105ae46189e60d96a731ccdd71d3f30390d309e93d54a2d02203b46c09ce3ec681604555831b0bfcaf33dac1cb423ec0973e8f144359a46258a1d9b5926fb5de8ea8e9423698fa80d5fdb1431e2d0ccd91e861fe5c75289659e93d945de236bed292c4e0631de6e95cf67045e51b4164642f4fe48880727f8d4ecd9cca9292a214045c8bf27f369aaadda8bbda39dc548c4fcf08eaca2f6c9317ea356d19f01fdcfbbd0dece29c630418c15e588c7f23abf601a07fe164b9084685a4211fa75799b2a39c427f99968a9d0b9fabc8c7618d28c26a848a6aa2bdb4285527ac388dcf4581f1ca34921024a492151fc41cf69b61eda776aaf804faed57975ad3648e662becc2f5fdcad3541662900b9d526b9319cd0c296ef16e3b7179405b037da402d780f002d906a9e218d2541607a8e7712414488947a9300160c7909757dac33906986902eb4bdcff4853b5c230f82f87459eb98ec820a014a63fd4a944067a7ab092ee466379d785fde20c88c161360b19e605f98421ae5a0c1f7b41bfd6364b1aba8f981b0c017e2795f49145460eb6d807034fea84b7ad4239423478be3dc2f2572679d20125b3ffcb65b2ab34166ec42e57f44d4285678f24faed81eff5e25cbe51cb4fa97ca93fc8f1fbc401684bb98605908c95c6333a3975019412cece5e0b2d33cab9d51edabeae86c987f335abd84d5bc9eabd1d6b716f5bf385e5d8f38a22311091da7fecc6ff927836f0864c09ceaf98a44311c99ec052c515a9c5b835584b45452aabf5a4736a135cb864307491ed2a06272b04a9fec9716bbc3b36df42332e13317a2cbaccc1e2fd902dcdc17b266369173a4c2a79e4e22b08896ba7289f9c5fc8d1e183b1a79c48964e849acf42e8349bdb396aebdbc787e296506f69210580d0e235ceeabd80806d75da2efee93c7d64a257dd27634724d5b79f1a3d9c496b59b45e85577040454f2623f1b39ca1685b0ef0932847e96907a932a59175da369e7bd8d409162ee55325314146d13ecf36ca77db93838e67156da7457984c6263fa4dbf613afdde89f1d9e66f5f763364ced080f2bc777e963eef3b8c42ff72defd5dfcacafbdb1730dbda94090495ca9a200490e81e3acfd0a229e84b4d482e2fe01d6849881a26a3d28722bae3b5e703ded34acb20a3a12cfde5213ec6803b2bcbbd19c8c3e567071e29de56ec2c320d1fd2c3149f267064bb1a90b778f037bd2d9cdc3617374ebf215778d096910a9a394b21deb425414b6dcf749ca9489117b4ad8d81f283aef906ab98f8b1cb358231a9c665429844b9730e4430e934197dadf60d9f585b76ab1a5558a906bde97ffff4322e9c77bbbf00b81137171679ed58f0fd1ceaa81f75208f389f16968991aa9a5416c8ec65316de0c1d962de3f4d5e5f6c6cd8ca9c1dee75ab9464087dd482de1e2a8c6d1bab9275c5e0c8f888ea4bb86dc2d7fc8d57281c4aad11717c957ef9dab74bead0f98d9a2b5f59ad1173d9e9f58cac20a31a89292f78d8e20f616a1a9369de9be8f502ddb456849c8b05dd9c82d195a796d6d8d5337c08b03d59973c2d75bc49ca3ffba84c0f667d06b1f9e5d1568cd616f7b0c4e83f4f1d344886cc5d2ffb2ce0137756afc316dcbbb690debe8bf211dda57be26062c7b06fbd1c5dac57f25e40e930e6edcc26c5fcafaeeb7687484028728735896b94534c53c9d86ff1828364ff17c17df8466585bb6183a5dacbe50d0a449a8854204cb15527c3dcd8e3728bb5c590f959a496676bc679851297485adb0c9cdeaa16df43e1a53b87cfb4fd9f53bc09b347ddcf62323208358f6bd1bd41ce83296282305496dadfe1b4ab40033689ceaec088470ff86e5303f0e6313ef62bcee1fd9d28e4dbebb47c791a143611c2cfa3b33fff22b33d602e4247c73a069369d3abb9bae9790eecc84a487e0b85c9919a6274369f133861072950d479a61a8fb150a5311727b68acdf0905ba6b920991036877d4c1466ef16e54922d0b39a9a109379fddf9989daa9df2f943ddb8a9c2126e202db3a7b36266f3c5a655e120e3cdaf959d31b8272ff15adb8a4e48c17ec025bcc117af0a60f8629d04386568f92148951ffbe0682615aff0c307bd9b836319db2646602b544cf5c916b92605e88ab25da1998158cdfc7aadb02cde950cdc8df2f5cf0d7b2dbdf2b2aa8baa915b2b904c74f61266537d2062791bdfae0bb4178fb1eac87d8fbcb5dcbb523c6c26dc55711d8ba93c269cbdd4c63acd7eda843dbdc76423b57215444b73124866d6307bcbcd3a4915b8abab06272cd7c58499ba442a534327cae9f46d6d534a2143fabd4f0cb1e0d1219521321cd074145ee0bfeb6a4f110ac177a10337630e35012e91897deb62ff958f4813117d2904ff0952f0503bd350cac3f87c56b16b0be1929d7205c7277a8abe2b8079960065e1da358ff0bcc0153c88cebc4b055a975563b1f8f1498464dd60ab309e3badd0653a9f14407909cc50e546bddb1ac5e3a1bfde10d6f80c3ae0c362d9c7a9b784e2baf70218ac7838b132708d34d890373bb611c2b8226c947a45e639029c07c260ef91e8a83b0e4cc3f02b71432d5588334db8e2950456f63b1de3de8817bb4c01c125bbe7d9f3318d4001437276f48b697be231ebe1b7ec327d551e30bee2d39b541d71eee05adc7ebf68b6ea44050a5bacbccf8d87f1413305ae0490c5f0250d5c7f3e4e93971100300845218f9d622438c33e29290a58c26318f464439ff860451e83b4a1b165d3ca0bbbc38aa3b64fbaa50187e12a9fd56f4bd924a35a74a218d5f763494d47ed2fcb732aeb3f0b8afc2d47027c157cf4358e8917dd1eebaabdeb96ca47b875d331f2d83bd7e54ee99cca6d1de916a46a43de8a8b83c497f60fe00bd48ebb6e91e489092fa8da9b4292409433d0c3983a1c1e0acb7daa1f076172d2da672cdd8cecd2ea61680500e3b984a1e48893346263f0fe88f0c8e8eb5d28df28f53fab3320d70a97ae2da3d6b41ec7456922b12e07fdc170511c0157f77ee7f0f95ce5aa25300fa9db404e0f2ba092680156ae49af11d1d2c9f210ce732c7eaa560580fdf8e25966dd32170152cd9cc9e7cfcdadce04ce8feefe67f661e68aa25cee7c7e16ae8c06acaa7638ec00ebbe0dc77a117ed022e89b4038500a0ecf54db18e589d9ccb93c7ec49e6f6f57e2b9541a7edd1e51e8439eff9dec3ad797961376d6e4a548c5ec2612101a3c3769723d374e052b45144564ece4583c9d1aa8e139d16852c0353bf69fb62a9381f5c30bf9462ccd6502af300ebc757812315103e60010f8c859001604ff82c95a742c5edbfa3e382d71261f486a3b82cdd52aee54f419b911dc194ee46aa8c97dffd73530206ea5fa9ea44f23005ecdc62763cda1e3f3ae85229a108857b779ba271a6d9dd72b806e32abb19db12d911448cd765e1aae6510550f2842256e8765c182f15c309ee1d76a61221933d8271ea576bd295d1dbf018745746a67e3e893d26c5a4910f9d324df4af98045ca465dffdc18da46397a25ba76eda5abd51cc98c57561c4bfb27ee5d8f3c93d1faee9d967650651abee5638367e10123c6af7900c0907c393a0d99ad098c1e725538bffc1b33a30b0800e7189ef92b2c9f0d3e150bd3711f30b43be4e8866b41cef08af53f1053e665e8309fedee3b99b8a2bf24bd6680ea35af81e0361f01afad7e5024cbd4c4af3c210069491b6e21f705ffdbbe3192cf47f833ad5fede6da7a88d5427e8293c204f7af2a478eea75929f61f9f83755ebf011a95090342f9fb93a4c849e373b1ab3fe6adfaaa0b2816ab242f8d160aac08eaf63a955c8113d7287569ec6c2ac9f6165ec6f088ec5efe7e6fe641e997e57650b7071d86175c25f52c094dbc94fe34629d2deba8b379f617ad8c60132c713e54b5c0884690e742f019b73e25cd71a44dd81452ab153a534b88b678e461e12d8b3a3e3626648f785bd3a1b6daf1cea4fe899a059b3f2476e66146df9d2bdb489e833cfa3df218b369dcc82f014b8faf90d6d7863bd24daa116e34449499f3104c7c0842edd7c17c4904a4538244d658f7e656e06583f1bdbe4d7c2520322d9ca713555ce25ffc65e842098ccf8130b22082d7f93ff94016dfc7ea85e77c8c09f79fa5e5a564b5ffdb4d0b30dee3766d4c86aa976a533a25913ae78d36a316952d17f90fee31afe1438876de72654c479a07b7cf83a22ba06f0773dc3f6e31b356c0490be3b9f14bdae1e5221c08d71f5ea2e1a8260b93d3c0989db0269906b63b46c8e80583c652085b3a63c6f4d658905a05b20c68e6cfb84d31e753e9d660c1c37e26733f52bcc536df224a7a32bc1ea4ae967dcce2cd0298fa675a6c006cd74c7d499da09bc8dbc65f086c418e73eafa2aabd598b0698002a23d91c60b422d75afca4f78f1fb94ebd5994ae644e16784b3865300142c74da10ae5b46d8763292b7eea24da84549bd0e306050e3adab189d44ef9529ec39ca92c6c3e0743bf5dfd16060f315301f8e1adc8a26e2ea8c009e83c85eff402acd98e298ed87d0656b8a0c87844d110a9486a5da8096d9a633ab8ac5d1511f4041435af79f5acbcbd5dcb5adf14ad32dc32f5b067c8f812e4864c1f98a131b41fa8168987ac7d839f3ace4eb1f07267889e18123d845469de84173f42e9a717738e8516e72fdc04ecaf0623420400f4421399d121cdfecbf88b40712d13ed12bab77c9b92ff0837425c134aed9f2d8f90ce5b6fb59a0630a053725fd1696b27667267234dd80e329ab82703bbcdaa1823740c70a036a581a41c85adf8acc3d834b63bafa2b13d01ba5badaebe2786f001690eb9f2aead600cc97532dc6c38fa7909cac5c3b998130e713db36074893c902fa941253900412cd650c32ad9e279e53d3af757d362e6794438b5b", 0x1000, 0x8}], 0x800000, &(0x7f0000001880)=ANY=[@ANYBLOB="7468726561645f706f6f6c3d7e3c35343437382c636865636b5f695c745f7072696e745f6d61736b3d397f2d002c7468726561645f706f6f6c3d372c626172726965722c6e6f747265656c6f672c7308000000faffffff7469643d783239002c00fe790c43d036ac089398c1041d19b311ce934f4e2255cee84041adb1e1632c1c99683c9932469173636dae342de83274ca3c38a7ceaf7b08fa7eeb58a096c2227d1635f3c98f9e05000000edebaf847b5a93e873e770c8956b9acc8c0596bd7ac198b58524a9331274ec1d95ba5e578a3f7f2313ae7005f41091f450e3475a1f022f0fc41e27b9b6f4d43cba7d1287bf57f66726efb4bc012ec44dd3df4e7ee9f1129b85374f2ce705f198bb1313a70921be01f5c34f203d480efb1186856ca4bb47654f33ee73461305f69bc4fe7e11ea8d22d41f5e13347a660d98688842d23ab9074767253c5218e0e39648acc4eb45e20000ea2c27de24b05d5836ffea1299a6a988eeb17a44f803a0c85aa3d9e38a3c06067c79cce66eced92ffdcbcea54e88f300d6334b8fc576b1fe421c783f51612d7e752ee749a98a7a446df5067804e0b765b3411da64cd5e644a8c1d9b400c7651c66191456903be5b06a6676876ca67773ff8823e584557614bf2c35ddaeebbc7b8c65695173e94ab381426e3484de1c55339252960acad9808cde9196d6e78edcf9b5f9010f37970c8038302699ed5124354c8cd5273bc06a346d79cf06bc5ceb977b23e6d2ac1bf03cacc388ab3f94c675f6acc76dcde972df4ce0c88553693c1a5109a643bc1be9867c222fcfed53b9f419fc938974a296f26fc94888b3a15e7481c77a2b48693416031eb7"]) 03:00:38 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:00:38 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xfffffff6, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:38 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) [ 137.597174] binder: send failed reply for transaction 117, target dead 03:00:38 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xfd, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:38 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xedc000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:38 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0xa01, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00005befdc)) r3 = syz_open_pts(r2, 0x20201) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f00000002c0)={r4, @in={{0x2, 0x4e20, @rand_addr=0x1}}}, 0x84) write(r3, &(0x7f0000000140), 0x28d) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') 03:00:38 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:00:38 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x31, &(0x7f0000000200)={@empty, r1}, 0x14) 03:00:38 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000000)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) r0 = dup(0xffffffffffffff9c) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f0000000080)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000040)='./file0\x00') [ 137.679008] binder: release 10738:10739 transaction 121 out, still active [ 137.686041] binder: unexpected work type, 4, not freed [ 137.691325] binder: undelivered TRANSACTION_COMPLETE [ 137.703748] binder: invalid inc weak node for 122 [ 137.708675] binder: 10738:10739 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:38 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) [ 137.752304] binder: send failed reply for transaction 121, target dead 03:00:38 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x700000000000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:38 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)={0x4}) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) 03:00:38 executing program 0: socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$int_in(r0, 0x5421, &(0x7f0000000040)=0x9) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x12) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000000c0)=0x0) ptrace$setopts(0x4206, r2, 0x2, 0x40) r3 = semget(0x2, 0x3, 0x26e) semctl$SETALL(r3, 0x0, 0x11, &(0x7f00000001c0)=[0x100000001, 0x6, 0x0, 0x6, 0x7, 0x8, 0x3ff, 0x899f]) connect$nfc_llcp(r1, &(0x7f0000000140)={0x27, 0x1, 0x1, 0x4, 0xfffffffffffffffe, 0x7, "9a9cf8d237ea179c372dd4570b16adf80e2849af42013d57a550234369b13a5d1a76614fa1b16d8b2bbe5708d71009dd64a932fe02ae5b9b5e438c310f1e0d", 0x5}, 0x60) 03:00:38 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x100000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:39 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x11, &(0x7f0000000200)={@empty, r1}, 0x14) 03:00:39 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) [ 137.834260] binder: release 10770:10771 transaction 125 out, still active [ 137.841266] binder: unexpected work type, 4, not freed [ 137.846561] binder: undelivered TRANSACTION_COMPLETE [ 137.856536] binder: invalid inc weak node for 126 [ 137.861537] binder: 10770:10771 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:39 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xc0ffffff, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:39 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x2000, 0x0) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000040)=0x100000000, &(0x7f00000000c0)=0x2) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0xfffffffffffffffc, 0x0, 0xfffffffffffffffe}) r3 = syz_open_pts(r2, 0x20201) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) fstatfs(r2, &(0x7f00000002c0)=""/4096) write(r3, &(0x7f0000000140), 0x28d) 03:00:39 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') rename(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') 03:00:39 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) chroot(&(0x7f0000000000)='./file0\x00') 03:00:39 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x32, &(0x7f0000000200)={@empty, r1}, 0x14) 03:00:39 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d34") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:39 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:00:39 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x2000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 137.978497] binder: send failed reply for transaction 125, target dead 03:00:39 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x7, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:39 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:00:39 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x30, &(0x7f0000000200)={@empty, r1}, 0x14) 03:00:39 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) mount(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='rpc_pipefs\x00', 0x0, &(0x7f0000000100)="36eac2c4b67887b877f314845d0d8db8f99c176379994bc5c19fb6abd42ec28c0cedf2296494ee6b71c9587a50de1d6b2d0bbe7c308a43f4babf896eb49d1b5be508cb794d09c9243b46689e7d70893c01ab87c9a642b9d064b7128d640b6f5da49eeab62de8b7449bb5880640734fd52209bcb8b4da21a6bf39404ce12ef0dbb8284346fb5b5e3527fa4010839a2af66abfb7723c399c64325baeeff8df839582f71f30cbfb19622e971f71134c61740e6b9884ada6ddef511219cca12c53625219030dba1dcce5436812ed000b9ab000aec68b13ff6cf1d7cd7f7071bd9c8999df61ee6b08cfe7831d5957c1") 03:00:39 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) fdatasync(r0) syz_mount_image$minix(&(0x7f0000000200)='minix\x00', &(0x7f0000000040)='./file0\x00', 0x1, 0x2, &(0x7f00000001c0)=[{&(0x7f00000002c0)="c8835a3f85b70010000000000000c310a200b1543bda779c1ed9055835288aa6c4e32aa5f1226fe3b98172f7794300548eb7153d295cd0fc03c69e11f9d6ede109783aae723d13ec89f0fe03bf43658e472c04cbfddf412910e4bcf1da0461df7a41c8fc70693a03ef432575714acaaeaf69f7d89e168879e31a4a008a0c9ee21beefaa49ef958be1bd2e4db459f86cca737d2188ad33550921c89de1821c2451eace6f7dc0198bcae41c25ba0cf75497a9fef3343d19ce63c05965a04dbeb55c512ebbafac885187f8e3a390ca327", 0xcf, 0x80000000}, {&(0x7f0000000080)="28653a123714fe529c1341aabbc18b359a6399a2a532051ae454705319fcbc57a8c1e0767d8d1060ab7cc24f10a55f199d52d121109c46", 0x37, 0xc7}], 0x800, 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:39 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffff9c, 0xae41, 0x0) ioctl$KVM_S390_VCPU_FAULT(r1, 0x4008ae52, &(0x7f00000000c0)=0x1) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00005befdc)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2}) r3 = syz_open_pts(r2, 0x20201) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000000)={'icmp6\x00'}, &(0x7f0000000040)=0x1e) write(r3, &(0x7f0000000140), 0xffffffffffffff63) [ 138.071630] binder: release 10811:10818 transaction 129 out, still active [ 138.078623] binder: unexpected work type, 4, not freed [ 138.084116] binder: undelivered TRANSACTION_COMPLETE [ 138.091367] binder: invalid inc weak node for 130 [ 138.096331] binder: 10811:10818 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:39 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x5d8000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:39 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x200000000000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:39 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d34") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:39 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x4d, &(0x7f0000000200)={@empty, r1}, 0x14) 03:00:39 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x7, &(0x7f00000000c0)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(0xffffffffffffffff, &(0x7f0000000140), 0x28d) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000000)=0x100, &(0x7f0000000040)=0x4) 03:00:39 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000000200)=[&(0x7f0000000040)='[ppp0\x00', &(0x7f0000000080)='2\x00', &(0x7f0000000100)='nodevself-!\\/vboxnet0{*\x00', &(0x7f0000000140)='qnx6\x00', &(0x7f00000001c0)='qnx6\x00'], &(0x7f00000002c0)=[&(0x7f0000000240)='qnx6\x00']) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') [ 138.219496] binder: send failed reply for transaction 129, target dead 03:00:39 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:00:39 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000000)='ntfs\x00', &(0x7f0000000040)='./file0\x00', 0x3, 0x5, &(0x7f00000003c0)=[{&(0x7f00000000c0)="8d4a8ee40dffe7f0b3b290de1e03aa181858d7b9a88871309215a9de093b3e1468a6855a62881044", 0x28, 0x2}, {&(0x7f0000000100)="8efbafee79baefcb17490df2f2ebe097ee318c078942d2dbddb1ae3ac4e4a452106ac7d967f38fe56bb8b113d5e88fb2ea1173401124b89e5941c7dc9f18969c1bc54b15dcf695fde2dfdc6d4f557bc777aa215562dbe925e4f1a3392c7058b8cbec6daf645fc2f0520e340bd34f49f8e51ccd368fab2fef2d5814ab5c646cefc5c23790cb2549c8b2fa0ff57fa1be", 0x8f, 0x80}, {&(0x7f00000001c0)="f667b6ec1bcf949e0371308c3caace0db985758d5bafb91592d138db784de1d29d26d0f5571c5c0e7f114e244a63e2619888f42e99fa94cbc0bf01819c80203e6e26635cdaebac0834db1fdfa32f43e92ec1ab9780c20c87849ee1", 0x5b, 0xcb87}, {&(0x7f0000000240)="340f45a1357b86b80af679867fe6f4a8df00e660fb921f5bdba88c16881e9dc985fab220e982d2793d73059691553966b2b8f829b01df780d3040af35f040377d5759e3a8618d4ff4dff17e203ed2f324d687010edf9e2b743e7b4122d6d", 0x5e}, {&(0x7f00000002c0)="7b14c67d3a6aa66372eebac87573d8f7353c76aab10fe78b9794c8056f8b61d65df18c2adb2d96e61d1610594611ec722f38120db2d4e2017d8c1cb5b4b9e10b7f727bd4ec54b6a1f1c2152242cad4af870b5b83a7698680f6be11f18d0b67048bb0bb70fb4400026822ea5886b47b80935eb09959cf7ae6462ed11eea0cad9861eb55e3ef9a234b284330411d53bff535e6b990a3dd097541c1178857908bf7f55b7efec80eb86735b28da3e251689c6373d0e10231384e23bcf16da7d2ce5e943d8788b2d132b516519d9a9aa060d54976cd605d4a73ec874408ca45d0bba341c875cf3a7b8c7c23f1", 0xea, 0x5}], 0x100420, &(0x7f0000000440)) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x400, &(0x7f0000000000)) 03:00:39 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xcb1fda7100000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:39 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xe00000000000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 138.273118] binder: release 10859:10860 transaction 133 out, still active [ 138.280244] binder: unexpected work type, 4, not freed [ 138.285587] binder: undelivered TRANSACTION_COMPLETE [ 138.291323] binder: invalid inc weak node for 134 [ 138.296292] binder: 10859:10860 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:39 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x2c, &(0x7f0000000200)={@empty, r1}, 0x14) 03:00:39 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfffffffffffffffc, 0x10c00) ioctl$EVIOCGRAB(r2, 0x40044590, &(0x7f0000000040)=0x9) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r3 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r3, &(0x7f0000000140), 0x28d) 03:00:39 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x4000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:39 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d34") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:39 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:00:39 executing program 6: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0) ioctl$KDDELIO(r0, 0x4b35, 0x61) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') link(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mount$9p_rdma(&(0x7f0000000040)='127.0.0.1\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x1000, &(0x7f00000001c0)={'trans=rdma,', {'port', 0x3d, 0x4e22}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x7}, 0x2c}, {@timeout={'timeout', 0x3d, 0x235}, 0x2c}, {@rq={'rq', 0x3d}, 0x2c}, {@sq={'sq', 0x3d, 0x7}, 0x2c}, {@rq={'rq', 0x3d, 0xffffffffffff1118}, 0x2c}]}}) 03:00:39 executing program 0: pivot_root(&(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000040)='./file0\x00') mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x2, 0x2, &(0x7f0000000280)=[{&(0x7f0000000100)="1ac5e861fd16dd9e41f4524349a89eeeff3d4ce8d1329e4f93ccef27e4f2af71ddae07387a4eee0348d1c4e159f96c0b308058b5a1c7ddafd6799b9395fc41929b82a09bf5bbbfe36a5ad88f2acae541d7044d2158e74a1c2b342e5b7dcd46bcf2a34042cbef7bbfa3982ce0552351bfa9aaf2235a2081564b918a02155fffd5bc563026c223645eb1968eebcf1cc7426c225c30d0d3cbdf9aabdf372b09aa00f0d17aeb87bd34c363c9c04251", 0xad, 0x8}, {&(0x7f00000001c0)="6015da08a8f0405919722b8846a2d43cf4291afca4477935981ec5cad6cd545984b6f7a325b346363adf504fbc9b81e558d6a7c950d436060e1b232a190d6bf3902af9c404fd4a3ceaf905e5106f299050ed8059c3c4a3d7da4f87da38a5437506597ee9e1a834545747c07e138c3ac465bdd17f9d6776cfdd57164017e1ed9c011a3292d6b85aff32042a217bea", 0x8e, 0x8}], 0x880000, &(0x7f00000002c0)={[{@nojoliet='nojoliet', 0x2c}, {@sbsector={'sbsector', 0x3d, [0x34]}, 0x2c}, {@gid={'gid', 0x3d}, 0x2c}]}) 03:00:39 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x2000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 138.433260] binder: send failed reply for transaction 133, target dead 03:00:39 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x18, &(0x7f0000000200)={@empty, r1}, 0x14) 03:00:39 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)={0xfffffffffffffffd}) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) getsockopt$inet6_opts(r0, 0x29, 0x3f, &(0x7f00000000c0)=""/157, &(0x7f0000000000)=0x9d) write(r2, &(0x7f0000000140), 0x28d) [ 138.485483] binder: release 10908:10909 transaction 137 out, still active [ 138.492511] binder: unexpected work type, 4, not freed [ 138.497806] binder: undelivered TRANSACTION_COMPLETE [ 138.503120] binder: invalid inc weak node for 138 [ 138.508038] binder: 10908:10909 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:39 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x7000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:39 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x2d8, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:39 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x48, &(0x7f0000000200)={@empty, r1}, 0x14) 03:00:39 executing program 6: mount(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='hfsplus\x00', 0x2, &(0x7f00000001c0)="e6cf8fbf9e0b629f9de07b23b797f5cdc0cb7d2d601bebf0e2d2bb9778ea1abeee67f3335ad706ec888dc4496d0a871b2884ce7b22e37bd52b22601cf66c962f64d43a4a9142f90519560df7339d76b82ddee32896d527861de79521569d1d01569bfbf060d3f86e0a7d26af29c4c1e75a") r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x9, 0x129000) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000000280)={0x0, {0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, {0x2, 0x4e20}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x10}}, 0x80, 0x6, 0x6b, 0x5, 0x400, &(0x7f0000000240)='gre0\x00', 0x7fffffff, 0x7}) mkdir(&(0x7f0000000540)='./file0\x00', 0x3) ioctl$KVM_SET_CPUID2(r0, 0x4008ae90, &(0x7f0000000780)={0x7, 0x0, [{0x0, 0x2, 0x6, 0x1f, 0x5, 0x4, 0xdc}, {0xc000001b, 0x100000000, 0x7, 0x3764, 0x7ff, 0x7330, 0x2}, {0xc0000000, 0x6, 0x4, 0x81, 0x2, 0x0, 0x6}, {0x7, 0x2, 0x4, 0xfffffffffffffff9, 0x5, 0x7, 0x5}, {0xc000001d, 0x8, 0x2, 0x7ff, 0x1, 0x2825, 0xfff}, {0x7, 0x9, 0x4, 0x1, 0x10000, 0x4, 0x3}, {0x2, 0xfffffffffffffe00, 0x5, 0x6, 0x200, 0x8001}]}) chroot(&(0x7f0000000000)='./file0\x00') mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000300)='./file1\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000380)={0x2, 0x0, 0xc, 0x12, 0x2, 0xffffffffffffffff, 0x1, 0x64, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000480)=0x400, 0x4) tee(r0, r0, 0x1, 0x8) ioctl$KVM_SET_CPUID2(r0, 0x4008ae90, &(0x7f0000000640)=ANY=[@ANYBLOB="021728b4c20855e7f512bd1694a047cf000000000000001b000080fbffffff02000000080000004aa3000012fbc67d050000000000000000000000000000000400006e5e95e8cb3c6ed75440ff0f000007000000000000004a3de7d0bd4459d4f21e42de14cb640191da776225e0fa18a01cfac36b3561578fd59795893e21e7f7cef63c10d1874b897cef01dbb55ddfbddac5b313b71e0dd99e2b1158b62d2f595262917fa935c3d05420a043f26bd6da51eb075b1ac0bef25e14fa5b1f6ba284fbc4feccc5175effc844fa71c491e3d2f1581e5d2a6990ea3304b5eeec2eba6c29e7dd3188319511170dfadd06b4d06f540744517d1e5c4745886f4f85f1edf967fa3f08fd8991d71d25bb1de35abc955cc6e17667caa32c5ee11602b4e664ae3d6bdee15ba32022fb93"]) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') syz_kvm_setup_cpu$x86(r0, r0, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000340)=[@text64={0x40, &(0x7f00000003c0)="f2f046819d00a00000ef680000b9550a00000f32366647a01f4001dc00000000470f22870f20e035000400000f22e00f62b7669c96182626460f01dfc744240006010000c744240200200000ff1c240f3226f30f35", 0x55}], 0x1, 0x8, &(0x7f0000000480), 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 03:00:39 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x54400, 0x0) lremovexattr(&(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000040)=@known='system.posix_acl_default\x00') r0 = dup(0xffffffffffffffff) accept$packet(0xffffffffffffff9c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000100)=0x14) bind$bt_hci(r0, &(0x7f0000000140)={0x1f, r1}, 0xc) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:39 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:00:39 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x700, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:39 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f76") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:39 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) syz_open_pts(r1, 0x20201) syz_init_net_socket$llc(0x1a, 0x0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000200)={0xd5a, 0x9, 0x1ff, 0xc3d4, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x800000008}) write(r0, &(0x7f0000000000), 0x0) timerfd_create(0x3, 0x0) [ 138.680730] binder: send failed reply for transaction 137, target dead 03:00:39 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x43, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:39 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x35, &(0x7f0000000200)={@empty, r1}, 0x14) 03:00:39 executing program 6: clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) utimes(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)={{r0, r1/1000+10000}, {r2, r3/1000+30000}}) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') [ 138.739179] binder: release 10958:10960 transaction 141 out, still active [ 138.746216] binder: unexpected work type, 4, not freed [ 138.751519] binder: undelivered TRANSACTION_COMPLETE [ 138.761355] binder: invalid inc weak node for 142 [ 138.766294] binder: 10958:10960 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:39 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xa, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:39 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x4, 0x121001) setsockopt$inet6_tcp_int(r0, 0x6, 0x3f, &(0x7f0000000040)=0x7, 0x4) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x4) 03:00:39 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r0, &(0x7f00000009c0)="cb919d1892473b47ca93be46bb92c4f3451fc5addbf7f3fa2eefd44e2e5b78639b00f22185d964a318d85fe58683bbb93004ee278295c538ce5ae5a59901b8ac98d7091fd98da00f82edbd852b33fa3e76a985a1039a22318ebbd54fc7ee175073daa8707d400dc11b8e564cb9161109120680f501542c71a874b97a3e49a7b2b68e7c7f3179a762defe7f8b41d317374952f7b9169c1ce231ad342edb1e21a948a2fa038b8d6d481184b49ccb58adac9732e313debd76ba651b76329c3889ef71b1ec320c6d96bd944795f42cc5b223fe28137eac321dbcc88367e902a63c9ac1406721192e247b0bb90fecff1c324c0060a3d1bfb7cf66dd79654e58f3f8abbdb359dc0b39bd36d0d9cef72972a86fc6fb6726c3649828e0252c54d35e822ad1c996c5f577f2c2c30cc89a96482d0db3e41d04310e9dd64517ea2a9eb7ecac6f90c46e27c07d9a86bfd4771cd4e79d953926461c18bdb2a6e7ba411659000000000000000000000000", 0x4a6) 03:00:39 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x4, &(0x7f0000000200)={@empty, r1}, 0x14) 03:00:39 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:00:40 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f0000000340)='qnx6\x00', 0x1000, &(0x7f0000000300)="23d36d84ac297c34eb5120f857399596a6d78fc078bd3f2788e02b23ff44b8c8285477965a10dda9db2240cb642087baa2e3d2fcac46") pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f0000000100)={0x3, 0x5, 0x3, {0x0, 0x1c9c380}, 0x6, 0x200000}) chdir(&(0x7f0000000040)='./file0\x00') setsockopt$inet6_dccp_buf(r0, 0x21, 0x82, &(0x7f00000001c0)="efaa05fbd0b8cdb44c7397adc092db66bd4eb51aef9423723feeb5d4c280bcc6c3a6798df40d6b630b44018fbdaa74c99519a2709d66fd00b4adf347ebda014efbe15367127749e13cc65b38d0d4f2e81662e7d839c2de9f7fa3861ebdb862f63cbd9eac56ec499006c7f06766e14a04a94cf45796fe865aab296ab98ccb46092e23e4a2", 0x84) 03:00:40 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xffffffff00000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:40 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f76") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:40 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x100000000000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 138.884588] binder: send failed reply for transaction 141, target dead 03:00:40 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000000000)) 03:00:40 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000040)={r3}) 03:00:40 executing program 3: r0 = socket$inet6(0xa, 0x32a81ab12fb7f049, 0x408000000) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) sendmsg$rds(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x2, 0x4e24, @multicast1=0xe0000001}, 0x10, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/128, 0x80}], 0x1}, 0xd0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x5abbfb2e77ae6dff, 0x0) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) [ 138.936046] binder: release 11001:11002 transaction 145 out, still active [ 138.943033] binder: unexpected work type, 4, not freed [ 138.948327] binder: undelivered TRANSACTION_COMPLETE [ 138.953732] binder: invalid inc weak node for 146 [ 138.958631] binder: 11001:11002 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:40 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f0000000200)={@empty, r1}, 0x14) 03:00:40 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x1000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:40 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x220) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:40 executing program 6: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r0, &(0x7f0000000440)={0x1f, 0x0, {}, 0x0, 0x5bbee132}, 0xe) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000000)=@get={0x1, &(0x7f00000002c0)=""/199, 0x4}) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:40 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f76") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:40 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x9000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:40 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x80fe]}, r1}, 0x14) 03:00:40 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000040)={r3}) 03:00:40 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = memfd_create(&(0x7f0000000000)='\x00', 0x3) write$P9_RREMOVE(r2, &(0x7f0000000040)={0x7, 0x7b, 0x1}, 0x7) r3 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r3, &(0x7f0000000140), 0x28d) [ 139.084190] binder: send failed reply for transaction 145, target dead 03:00:40 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f00000000c0)='./file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000000000)="89225acbfce86bffdb14b3ac9537b3608d87939f85714473071d4edea437b12a1ce219ccabf349853e7b28b8656d25584572b324172b2f248f9d000000004b0fe0f83ae9", 0x0, &(0x7f0000000180)="aec41d393b14f51e39aeef9633700aa0c84d000000001b47f107b09d4ec743dce92166866eb26916078af96aca2d7cdee34fa780184a59ca3d4c4a08d3f741283527bcc1b717e20281d7f89205f4365df9440ef991ce69408202bdb330c816dfba9b6511652ffb50890532") [ 139.157965] binder: release 11040:11042 transaction 149 out, still active [ 139.164994] binder: unexpected work type, 4, not freed [ 139.170309] binder: undelivered TRANSACTION_COMPLETE [ 139.177503] binder: invalid inc weak node for 150 [ 139.182436] binder: 11040:11042 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:40 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xff00000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:40 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='gfs2\x00', 0x1, 0x0) mount(&(0x7f0000000040)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) 03:00:40 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f7620") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:40 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0xff00000000000000]}, r1}, 0x14) 03:00:40 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xa00, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:40 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000040)={r3}) [ 139.225373] binder: send failed reply for transaction 149, target dead 03:00:40 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) 03:00:40 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = shmget$private(0x0, 0x2000, 0x820, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_INFO(r0, 0xe, &(0x7f00000000c0)=""/184) 03:00:40 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0xfe80000000000000]}, r1}, 0x14) 03:00:40 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xe00, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 139.324141] binder: release 11069:11073 transaction 153 out, still active [ 139.331166] binder: unexpected work type, 4, not freed [ 139.336463] binder: undelivered TRANSACTION_COMPLETE [ 139.351918] binder: invalid inc weak node for 154 [ 139.356849] binder: 11069:11073 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:40 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) fcntl$setpipe(r0, 0x407, 0x1f) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)={0x0, 0x0, 0x0, 0x0, 0x9}) r2 = syz_open_pts(r1, 0x20201) ioctl$VT_GETMODE(r2, 0x5601, &(0x7f0000000040)) r3 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x8, 0x1) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r3, 0x3) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) name_to_handle_at(r1, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0xc3, 0x3ff, "f97768471bf3e8da8dc20d4d48645cf428eec1fa99665cc895676a51ad4eaf8d38539b1c0fcbac1f5c07898c94e75b804c0ffddf05f7bb83128b359b956b705bd46af60abc105fc51675727b6aada008ffedc8cedf10de294de7893ee4d8702052ba94746733eaf416d51d55cf109117cd146c0e9912cfeb24ecf952003f1e6d5eacccc856b803cd07cc0112edae9106f1d59fc25db69af2042bfab9bb95308b0df6f8bf42bb3da32e1d5f6da16b3b552eb9404a6fc301fb320894"}, &(0x7f0000000240), 0x1000) write(r2, &(0x7f0000000140), 0x28d) 03:00:40 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') mount(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='efs\x00', 0x208000, &(0x7f00000001c0)="22a5f0b39675aa3e39ee1663b2cbd4f77112c7eb09da3f2a6f043fbc93ee7ef51ce15958db0e29d4ef081bae128d8c78d6a3f0ada7de546a986c0b938a7eceb1e95a36e4497d6f3084acc340bcaf3b19cdc25c77590d5fbaacc667d811d9f44f64d34ffeb7fa948e63b5d8c5425aedd731a6328d5c09812ee801d06bda85f455741c1f89953298d97398eece425dab5683f1c3a74c07791bce") 03:00:40 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0xff000000]}, r1}, 0x14) 03:00:40 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x4300, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:40 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f00000000c0)='fuse.', 0x1ffffffffe, &(0x7f0000000000)="6b3796c1b0b2dea9c25f5bee689db96f528a4ab702712333ad3329dea3b1b88059c8004421987ca10fc66faf40782a5554adc82484e38fa2b2") 03:00:40 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)) 03:00:40 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f7620") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) [ 139.487302] binder: send failed reply for transaction 153, target dead 03:00:40 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x900000000000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:40 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x82) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) socketpair(0x5, 0x80000, 0x20, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$vsock_dgram(r0, &(0x7f0000000100)={0x28, 0x0, 0xffffffff, @any=0xffffffff}, 0x10) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x22, 0x4) getsockopt$bt_BT_SECURITY(r1, 0x112, 0x4, &(0x7f0000000140), 0x2) accept$alg(r1, 0x0, 0x0) accept$unix(r1, 0x0, &(0x7f0000000080)=0xffffffffffffff50) 03:00:40 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r2 = getpgrp(0x0) fcntl$setown(r1, 0x8, r2) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x400880, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100)={0xffffffff}, 0x111, 0xf}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r3, &(0x7f00000002c0)={0x14, 0x88, 0xfa00, {r4, 0x0, 0x0, @in6={0xa, 0x4e22, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x100000000}}}, 0x90) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r5 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r5, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) ioctl$VHOST_GET_FEATURES(r3, 0x8008af00, &(0x7f0000000040)) write(r5, &(0x7f0000000140), 0x28d) getsockopt$ARPT_SO_GET_ENTRIES(r3, 0x0, 0x61, &(0x7f0000000180)={'filter\x00', 0x3a, "a46842a96fc7bee5b6d98133f8c2f8725458946aa15c97153684256681601287c9c155a41f59c03abea9b4533b4d34dd46606b2a1c292d9c4d94"}, &(0x7f0000000240)=0x5e) ioctl$TIOCGPGRP(r5, 0x540f, &(0x7f0000000000)) 03:00:40 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x6, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:40 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0xfe800000]}, r1}, 0x14) [ 139.529502] binder: release 11125:11126 transaction 157 out, still active [ 139.536507] binder: unexpected work type, 4, not freed [ 139.541803] binder: undelivered TRANSACTION_COMPLETE [ 139.556204] binder: invalid inc weak node for 158 [ 139.561215] binder: 11125:11126 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:40 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x97ffffff00000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:40 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) r3 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x40) ioctl$BLKGETSIZE(r3, 0x1260, &(0x7f0000000040)) write(r2, &(0x7f0000000140), 0x28d) 03:00:40 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)=0x0) migrate_pages(r0, 0x10001, &(0x7f0000000140)=0x3800000000000000, &(0x7f00000001c0)=0x401) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer\x00', 0x4000, 0x0) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000240)=0x4, 0x4) memfd_create(&(0x7f0000000080)=':!nodevx\x00', 0x2) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x8001, 0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x2}) pivot_root(&(0x7f0000000100)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:40 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)) 03:00:40 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0xff00]}, r1}, 0x14) 03:00:40 executing program 0: mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0) r0 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0xe, 0x30000) r1 = open(&(0x7f0000000080)='./file0/file0\x00', 0x400000, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f00000000c0)={0x3, r1}) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000000040)) 03:00:40 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x500000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:40 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f7620") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) [ 139.705972] binder: send failed reply for transaction 157, target dead 03:00:40 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x1c) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:40 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xffffff7f00000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:40 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0xfe80]}, r1}, 0x14) 03:00:40 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x6, &(0x7f00000000c0)="025cc43d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x800, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)={0x0, 0x0, 0x0, 0x3}) r3 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) write(r3, &(0x7f0000000140), 0x28d) sendfile(r1, r3, 0x0, 0x6) 03:00:40 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)) 03:00:40 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xa000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 139.776302] binder: release 11181:11182 transaction 161 out, still active [ 139.783307] binder: unexpected work type, 4, not freed [ 139.788678] binder: undelivered TRANSACTION_COMPLETE [ 139.797214] binder: invalid inc weak node for 162 [ 139.802139] binder: 11181:11182 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:40 executing program 6: chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x3, 0x200000) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000100)='tls\x00', 0x4) r1 = syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x482000) fcntl$dupfd(r0, 0x406, r1) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x200000, 0x0) 03:00:41 executing program 0: mount(&(0x7f0000000140)='./file0/file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000000000)="5a0df3b244cb8a80afd4c89a8528fe4be55387e7e51fd69288f1faca0997344c5b8a5b0482ceeeaf7fda607e7ae4874e3f218d8c31bf18b9502482f2048cde6b03d3bc480840d56ce9fd23823a49de4c4488dd7cd28a0000000000000000003118fb6d4f65de8a647670db86850f546489a086512fe8d9cf7e9a3debd5740e2e194a9112ad3b876d088ace7adfea82cc3daabe7d184421430c081d225849d463db3f6689a6329d266144a7fb3746c89164f6c558eee26b73f4a825c5cf76d65c8267d43085486522cefa8cd57a457afa1148acc52f6a8aaa9da3cfd552bac07c0fd44169") 03:00:41 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x0, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:41 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xfd00, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:41 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0xfe80000000000000]}, r1}, 0x14) [ 139.900436] binder: send failed reply for transaction 161, target dead 03:00:41 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x80c000, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) r3 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x80) ioctl$SG_GET_PACK_ID(r3, 0x227c, &(0x7f0000000080)) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r0, &(0x7f0000000140), 0x0) 03:00:41 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x6503, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:41 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xfd00000000000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:41 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000001600)='\x00', 0x400, 0x100) socketpair(0xe, 0x7, 0x9, &(0x7f0000001700)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = memfd_create(&(0x7f0000001800)='btrfs\x00', 0x2) r3 = syz_fuse_mount(&(0x7f0000001840)='./file0\x00', 0xa000, 0xffffffffffffffff, 0xffffffffffffffff, 0x1d5e, 0x140000) r4 = epoll_create(0x9) r5 = syz_open_dev$adsp(&(0x7f0000001e80)='/dev/adsp#\x00', 0x7fffffff, 0x40001) r6 = mq_open(&(0x7f0000001ec0)='{\x00', 0x1, 0x40, &(0x7f0000001f00)={0x7, 0x100000001, 0x5d80, 0x3ff, 0x80, 0x5, 0x3, 0x7}) r7 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000001f40), 0x4) r8 = signalfd4(0xffffffffffffffff, &(0x7f0000001f80)={0xb2}, 0x8, 0x800) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000002000)={&(0x7f0000001fc0)='fuse.'}, 0x10) sendmsg$netlink(r0, &(0x7f0000002080)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000001640)={0xb0, 0x29, 0x12, 0x70bd2b, 0x25dfdbfe, "", [@generic="1d6cb46e07ff0614b7404353d95df7343ce3b38be3417b41cf38ac75b15986e1fd3168a9fb23b0119c00c262d62438929289025b7d54190a6305b6b817b94b6a5b038e018697ae7e508b4eb7bb202ea8351aaa7f45749993e6f52a6ad02e53953285fa9099a6158daba52aa382162c618089da03e19955442bb15ee085f8179b0db08b4501f72e65b1b0657b1cdf4acb426c18fb4ecb7b9e693844bb08e625"]}, 0xb0}, {&(0x7f0000001b00)={0x1d4, 0x35, 0x800, 0x70bd2b, 0x25dfdbfd, "", [@typed={0x8, 0x1e, @u32=0xc339}, @nested={0x1a8, 0x34, [@generic="5a3c9a1f3bbe2201959ffa501c75fa15a763ece18c8eaff820bfbc130187c58f3335446ab8367bd108d6635de492c1ddd652066e2a3e1f4ba599e5815575cedf44b50c12f827e5eb351317fe1ba8b72d40125524b403bab35f73604ff3a4ae2b5509f6c8dadb04f0f746ca2001c92a004f0cc78f6d1781b086c11ca25717d3942fbaf1c43e27c7a61b34a3ce65c9c910a8a5215f487e1a1010beea63e20c90fa", @generic="de24c58560e65ea52f3674ebec4ef68bdf6c6489ad72f43e673eb7f12f74e84872fb5510706530bd3d319a5750c6a4f8aff07660f564faeb8850131d1f53f2a7e61238fa27344380c5e98242e82383935fc072675c6bdcd2953f2fa26b4456b5a21f80b33b67edd57400e342362acfde3112ab886b89494158c59e3c7441f0cc4e61b77f667d2c3ebacb2ffb9c425a538396778292114dd065d938666f508dea5346e068aa037703c75871f4dbe8d141b10329085c93547efc2b0e9a4a77a6910bcf3ae68f444b97c364267fad6fd6b0929d035beda2dae563de3ed72264aaea7b33b2b69e1d3b2f23a25d2c8ad5720e", @typed={0x14, 0x45, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}]}, @typed={0x14, 0x4b, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}]}, 0x1d4}, {&(0x7f0000001d00)={0x180, 0x29, 0x400, 0x70bd29, 0x25dfdbfb, "", [@nested={0x170, 0x62, [@generic="41bbc2a003922afd458b10b003b1cb2e3d45f00fc8dd440b937a5e8b842e65a1c9c57d952afd3e9a7ab00e46625f3ec66d9a82641957", @typed={0x8, 0x72, @ipv4}, @typed={0x28, 0x4, @binary="3f7b81ac6f6e8ae7183809c5f92601d853fe1e820037c65885004184527c9fca50ebe5"}, @typed={0x8, 0x22, @fd=r1}, @generic="124e1783f17d6f262b9efb8da59b72252341ad63881e997e33074e015f984b2ab5b3e2b34068c818d464c30538c9f6a01cae756a1815ba53fd5c3803bc8599703d703fe18507f306229117a1cedb2fc70e4aac9e7acfd67382bf8ba1c85c8a35be7336f1bfb3a2064e4f5eb409bbebae51ce5bb9951cba1a6855a5cda34ddcd18265fcad87de2b59d0197a2ede15cc7bdcd7e2664f5747f7541b5165c26d90bf5fd53fb55cbaef839e80d9553e7dd64b2b15642562d17de18580694b5e618b7e9d093c641ccc2892dab22666bc1bbe96cc4750671d7b5d782d6dbfe5ae52ec711e7175a71dd8917f2775c7d342884d92d40835da8ffbec7286c8e8"]}]}, 0x180}], 0x3, &(0x7f0000002040)=[@rights={0x30, 0x1, 0x1, [r2, r3, r4, r5, r6, r7, r8, r9]}], 0x30, 0x1}, 0x40085) mkdir(&(0x7f0000000080)='./file0\x00', 0x1000) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f00000020c0)) r10 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, &(0x7f00000000c0)=0x80, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000000100)={0x0, 0xf87}, &(0x7f0000000140)=0xc) setsockopt$bt_BT_RCVMTU(r11, 0x112, 0xd, &(0x7f00000015c0)=0x8, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r10, 0x84, 0x18, &(0x7f0000000180)={r12, 0xffff}, 0x8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r11, 0x84, 0x18, &(0x7f0000001780)={r12, 0x7ff}, &(0x7f00000017c0)=0x8) mount(&(0x7f0000005000)='./file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) syz_open_dev$usbmon(&(0x7f0000002100)='/dev/usbmon#\x00', 0x4, 0x309000) syz_mount_image$btrfs(&(0x7f00000001c0)='btrfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x5, &(0x7f0000001540)=[{&(0x7f0000000240)="ca85442bc441418b0f24255538b610560ffbd2174cea36397150eb4e5a4fc8ace03c68b02e9b06b145c3359ee87e10c3a97bfc41cc9fcd78ea58fd60d54f91832c37a0393d75bff37dc96499ea0cc61d8cc08a84cec8c3e1f9cf775f4cd07825dd4d7145f2fba1462eb12fbba287ba78afe3e601dde2cfd4501f084629f7cfca1bf1a7891c2e0c692dd2787189dfb7712da9153a5a844709257da7ea1a2a80470ed1e92aa0805d87", 0xa8}, {&(0x7f0000000300)="a9e66b6ffc72cd8b4639fe32314ceac1ea75b1dfafe73edda8150325d057a1ef74942a7cce4962d621a35a53a63004a3103dfe4780b257cb7fba5c3b9b4c7b216b24016534abfa0b522ac395a4c630ac826f64056b1c2f603ec73443a363479e7bf75ce14b366d77e2d4f828cdd99442cbcf0c8d91bd578fc83fe1e50ac20bda277a113240b790eeefd5dd201da2cef590fb3def8956b8028ae4128618149e5ab956e91431f44d0e868a02569aaf78b396d7bf7ed8641494e1f43cd2ebd012eec7a20224ec276ce847595eb9cda7589c14ed902afeff70df933703d2393c8192eb1c51f49f9faabd397062f823218f478a4e08eaad48d67bdbe0", 0xfa, 0x652}, {&(0x7f0000000400)="322a06294cc3e96143929210338fefd847cd229e01f25341b744dbc9facf5d966e0a00c583bb6446db7d122199b0b3e4f9408106d9ccba1746cd8ee7cb20f180cae8b41b9e4200d843adb5d1ae80d25a464fd410498e328e411493be3f57d9e83dc102ac8f6d5fb4e50323bff43adfd8901f07060d65da8767d1e7f284b60749b5a03b1e85769fb43d6fc79b2fe27a1a3cd1141d62a45a6b13bae9aeb73de57880aacc779b37c6df01c4bb100284dc2e3ff636", 0xb3, 0x1ff}, {&(0x7f00000004c0)="8909a5d29196244f4acd534527214520db9ba8de6ad41bc3729a8d1c9458b525685fbd698d6bcb9f3d587e8f00320e8b12161754f12ddc1469b0b73ac7910e2e5564160f926e7b119a5cd4b0663aab1a1879e87206f92525a76f7a75191ce51a4c89e273d6", 0x65, 0x5}, {&(0x7f0000000540)="125c87e13cab9316c1051f8b390c2fb18dddb7655cc993c759c91f53c4c90ffe4a610260f70e2fdaf2dbab6a6911a23741e6dd49a75eb819f0cfcd13db1a4a48c163da2cd57d34f13689d07c9fabc192932f0c87f398531eb6ae22f3f628aa67b880b86c75f82f83fe88fc0d6cbad9e2b23a00b99132bf3148afc636dd6648253aff3143676b1e1c425195b00b0b3ecf7b6a42486237075f652765ac6d186393be7c01401531591632634fedb4188aae384fea2d204856acda1e22640ab24877ad393626aab6639dacf3e324ce2a226a05a815d1684569002b86e67beb9bf3b20ed5760ac1c42d2394e8f6830ff28f99a79b374d99e1bb7c0d5f2e660d6d01ce3343c075812f391a0d72d54a05432977244b98087327c7e50a60a4c948737d91a9b1ff47ace6189bb10711f6cea0a9fed9a8aba2b40333c48e2505b194b5d58c9884796f59daeea8f1389df0b2dc0d9e8979a8b6f5d04c9187a593d042226626d86ead1fa98c480703afefa3f9cff4647fff4d465341192103c871b0280afcdabaf5e7b68a3fb3928b8efe9a4726f47bb47c13c402a7c3f7058012975c9a799d84606e66085771e737f5466cb37a7d3d1a264ee8339ae7605fe8048a0b398e296376beb1c84f2ad0c717f036826c57a3e2c0f420d462f349152d9db09b6961e94a066cd0e26ac9452e6b7c1c0a8531a2dabaa7db93cb69ffb52b0d46cddd46d4c0c9e1582835899ae6e17af1d8a7fa1d638bf8e6dee1eca2a7783d75885dc2b9785659241b8a3e1bd6383db933f92ab8593abf2d9d11fd282d208222902b745a641454c5bb2deba5cb874a2a5904304ba5b56a93bbe2bd617ecb5d4ce2262e1ffa105ae46189e60d96a731ccdd71d3f30390d309e93d54a2d02203b46c09ce3ec681604555831b0bfcaf33dac1cb423ec0973e8f144359a46258a1d9b5926fb5de8ea8e9423698fa80d5fdb1431e2d0ccd91e861fe5c75289659e93d945de236bed292c4e0631de6e95cf67045e51b4164642f4fe48880727f8d4ecd9cca9292a214045c8bf27f369aaadda8bbda39dc548c4fcf08eaca2f6c9317ea356d19f01fdcfbbd0dece29c630418c15e588c7f23abf601a07fe164b9084685a4211fa75799b2a39c427f99968a9d0b9fabc8c7618d28c26a848a6aa2bdb4285527ac388dcf4581f1ca34921024a492151fc41cf69b61eda776aaf804faed57975ad3648e662becc2f5fdcad3541662900b9d526b9319cd0c296ef16e3b7179405b037da402d780f002d906a9e218d2541607a8e7712414488947a9300160c7909757dac33906986902eb4bdcff4853b5c230f82f87459eb98ec820a014a63fd4a944067a7ab092ee466379d785fde20c88c161360b19e605f98421ae5a0c1f7b41bfd6364b1aba8f981b0c017e2795f49145460eb6d807034fea84b7ad4239423478be3dc2f2572679d20125b3ffcb65b2ab34166ec42e57f44d4285678f24faed81eff5e25cbe51cb4fa97ca93fc8f1fbc401684bb98605908c95c6333a3975019412cece5e0b2d33cab9d51edabeae86c987f335abd84d5bc9eabd1d6b716f5bf385e5d8f38a22311091da7fecc6ff927836f0864c09ceaf98a44311c99ec052c515a9c5b835584b45452aabf5a4736a135cb864307491ed2a06272b04a9fec9716bbc3b36df42332e13317a2cbaccc1e2fd902dcdc17b266369173a4c2a79e4e22b08896ba7289f9c5fc8d1e183b1a79c48964e849acf42e8349bdb396aebdbc787e296506f69210580d0e235ceeabd80806d75da2efee93c7d64a257dd27634724d5b79f1a3d9c496b59b45e85577040454f2623f1b39ca1685b0ef0932847e96907a932a59175da369e7bd8d409162ee55325314146d13ecf36ca77db93838e67156da7457984c6263fa4dbf613afdde89f1d9e66f5f763364ced080f2bc777e963eef3b8c42ff72defd5dfcacafbdb1730dbda94090495ca9a200490e81e3acfd0a229e84b4d482e2fe01d6849881a26a3d28722bae3b5e703ded34acb20a3a12cfde5213ec6803b2bcbbd19c8c3e567071e29de56ec2c320d1fd2c3149f267064bb1a90b778f037bd2d9cdc3617374ebf215778d096910a9a394b21deb425414b6dcf749ca9489117b4ad8d81f283aef906ab98f8b1cb358231a9c665429844b9730e4430e934197dadf60d9f585b76ab1a5558a906bde97ffff4322e9c77bbbf00b81137171679ed58f0fd1ceaa81f75208f389f16968991aa9a5416c8ec65316de0c1d962de3f4d5e5f6c6cd8ca9c1dee75ab9464087dd482de1e2a8c6d1bab9275c5e0c8f888ea4bb86dc2d7fc8d57281c4aad11717c957ef9dab74bead0f98d9a2b5f59ad1173d9e9f58cac20a31a89292f78d8e20f616a1a9369de9be8f502ddb456849c8b05dd9c82d195a796d6d8d5337c08b03d59973c2d75bc49ca3ffba84c0f667d06b1f9e5d1568cd616f7b0c4e83f4f1d344886cc5d2ffb2ce0137756afc316dcbbb690debe8bf211dda57be26062c7b06fbd1c5dac57f25e40e930e6edcc26c5fcafaeeb7687484028728735896b94534c53c9d86ff1828364ff17c17df8466585bb6183a5dacbe50d0a449a8854204cb15527c3dcd8e3728bb5c590f959a496676bc679851297485adb0c9cdeaa16df43e1a53b87cfb4fd9f53bc09b347ddcf62323208358f6bd1bd41ce83296282305496dadfe1b4ab40033689ceaec088470ff86e5303f0e6313ef62bcee1fd9d28e4dbebb47c791a143611c2cfa3b33fff22b33d602e4247c73a069369d3abb9bae9790eecc84a487e0b85c9919a6274369f133861072950d479a61a8fb150a5311727b68acdf0905ba6b920991036877d4c1466ef16e54922d0b39a9a109379fddf9989daa9df2f943ddb8a9c2126e202db3a7b36266f3c5a655e120e3cdaf959d31b8272ff15adb8a4e48c17ec025bcc117af0a60f8629d04386568f92148951ffbe0682615aff0c307bd9b836319db2646602b544cf5c916b92605e88ab25da1998158cdfc7aadb02cde950cdc8df2f5cf0d7b2dbdf2b2aa8baa915b2b904c74f61266537d2062791bdfae0bb4178fb1eac87d8fbcb5dcbb523c6c26dc55711d8ba93c269cbdd4c63acd7eda843dbdc76423b57215444b73124866d6307bcbcd3a4915b8abab06272cd7c58499ba442a534327cae9f46d6d534a2143fabd4f0cb1e0d1219521321cd074145ee0bfeb6a4f110ac177a10337630e35012e91897deb62ff958f4813117d2904ff0952f0503bd350cac3f87c56b16b0be1929d7205c7277a8abe2b8079960065e1da358ff0bcc0153c88cebc4b055a975563b1f8f1498464dd60ab309e3badd0653a9f14407909cc50e546bddb1ac5e3a1bfde10d6f80c3ae0c362d9c7a9b784e2baf70218ac7838b132708d34d890373bb611c2b8226c947a45e639029c07c260ef91e8a83b0e4cc3f02b71432d5588334db8e2950456f63b1de3de8817bb4c01c125bbe7d9f3318d4001437276f48b697be231ebe1b7ec327d551e30bee2d39b541d71eee05adc7ebf68b6ea44050a5bacbccf8d87f1413305ae0490c5f0250d5c7f3e4e93971100300845218f9d622438c33e29290a58c26318f464439ff860451e83b4a1b165d3ca0bbbc38aa3b64fbaa50187e12a9fd56f4bd924a35a74a218d5f763494d47ed2fcb732aeb3f0b8afc2d47027c157cf4358e8917dd1eebaabdeb96ca47b875d331f2d83bd7e54ee99cca6d1de916a46a43de8a8b83c497f60fe00bd48ebb6e91e489092fa8da9b4292409433d0c3983a1c1e0acb7daa1f076172d2da672cdd8cecd2ea61680500e3b984a1e48893346263f0fe88f0c8e8eb5d28df28f53fab3320d70a97ae2da3d6b41ec7456922b12e07fdc170511c0157f77ee7f0f95ce5aa25300fa9db404e0f2ba092680156ae49af11d1d2c9f210ce732c7eaa560580fdf8e25966dd32170152cd9cc9e7cfcdadce04ce8feefe67f661e68aa25cee7c7e16ae8c06acaa7638ec00ebbe0dc77a117ed022e89b4038500a0ecf54db18e589d9ccb93c7ec49e6f6f57e2b9541a7edd1e51e8439eff9dec3ad797961376d6e4a548c5ec2612101a3c3769723d374e052b45144564ece4583c9d1aa8e139d16852c0353bf69fb62a9381f5c30bf9462ccd6502af300ebc757812315103e60010f8c859001604ff82c95a742c5edbfa3e382d71261f486a3b82cdd52aee54f419b911dc194ee46aa8c97dffd73530206ea5fa9ea44f23005ecdc62763cda1e3f3ae85229a108857b779ba271a6d9dd72b806e32abb19db12d911448cd765e1aae6510550f2842256e8765c182f15c309ee1d76a61221933d8271ea576bd295d1dbf018745746a67e3e893d26c5a4910f9d324df4af98045ca465dffdc18da46397a25ba76eda5abd51cc98c57561c4bfb27ee5d8f3c93d1faee9d967650651abee5638367e10123c6af7900c0907c393a0d99ad098c1e725538bffc1b33a30b0800e7189ef92b2c9f0d3e150bd3711f30b43be4e8866b41cef08af53f1053e665e8309fedee3b99b8a2bf24bd6680ea35af81e0361f01afad7e5024cbd4c4af3c210069491b6e21f705ffdbbe3192cf47f833ad5fede6da7a88d5427e8293c204f7af2a478eea75929f61f9f83755ebf011a95090342f9fb93a4c849e373b1ab3fe6adfaaa0b2816ab242f8d160aac08eaf63a955c8113d7287569ec6c2ac9f6165ec6f088ec5efe7e6fe641e997e57650b7071d86175c25f52c094dbc94fe34629d2deba8b379f617ad8c60132c713e54b5c0884690e742f019b73e25cd71a44dd81452ab153a534b88b678e461e12d8b3a3e3626648f785bd3a1b6daf1cea4fe899a059b3f2476e66146df9d2bdb489e833cfa3df218b369dcc82f014b8faf90d6d7863bd24daa116e34449499f3104c7c0842edd7c17c4904a4538244d658f7e656e06583f1bdbe4d7c2520322d9ca713555ce25ffc65e842098ccf8130b22082d7f93ff94016dfc7ea85e77c8c09f79fa5e5a564b5ffdb4d0b30dee3766d4c86aa976a533a25913ae78d36a316952d17f90fee31afe1438876de72654c479a07b7cf83a22ba06f0773dc3f6e31b356c0490be3b9f14bdae1e5221c08d71f5ea2e1a8260b93d3c0989db0269906b63b46c8e80583c652085b3a63c6f4d658905a05b20c68e6cfb84d31e753e9d660c1c37e26733f52bcc536df224a7a32bc1ea4ae967dcce2cd0298fa675a6c006cd74c7d499da09bc8dbc65f086c418e73eafa2aabd598b0698002a23d91c60b422d75afca4f78f1fb94ebd5994ae644e16784b3865300142c74da10ae5b46d8763292b7eea24da84549bd0e306050e3adab189d44ef9529ec39ca92c6c3e0743bf5dfd16060f315301f8e1adc8a26e2ea8c009e83c85eff402acd98e298ed87d0656b8a0c87844d110a9486a5da8096d9a633ab8ac5d1511f4041435af79f5acbcbd5dcb5adf14ad32dc32f5b067c8f812e4864c1f98a131b41fa8168987ac7d839f3ace4eb1f07267889e18123d845469de84173f42e9a717738e8516e72fdc04ecaf0623420400f4421399d121cdfecbf88b40712d13ed12bab77c9b92ff0837425c134aed9f2d8f90ce5b6fb59a0630a053725fd1696b27667267234dd80e329ab82703bbcdaa1823740c70a036a581a41c85adf8acc3d834b63bafa2b13d01ba5badaebe2786f001690eb9f2aead600cc97532dc6c38fa7909cac5c3b998130e713db36074893c902fa941253900412cd650c32ad9e279e53d3af757d362e6794438b5b", 0x1000, 0x8}], 0x800000, &(0x7f0000001880)=ANY=[@ANYBLOB="7468726561645f706f6f6c3d7e3c35343437382c636865636b5f695c745f7072696e745f6d61736b3d397f2d002c7468726561645f706f6f6c3d372c626172726965722c6e6f747265656c6f672c7308000000faffffff7469643d783239002c00fe790c43d036ac089398c1041d19b311ce934f4e2255cee84041adb1e1632c1c99683c9932469173636dae342de83274ca3c38a7ceaf7b08fa7eeb58a096c2227d1635f3c98f9e05000000edebaf847b5a93e873e770c8956b9acc8c0596bd7ac198b58524a9331274ec1d95ba5e578a3f7f2313ae7005f41091f450e3475a1f022f0fc41e27b9b6f4d43cba7d1287bf57f66726efb4bc012ec44dd3df4e7ee9f1129b85374f2ce705f198bb1313a70921be01f5c34f203d480efb1186856ca4bb47654f33ee73461305f69bc4fe7e11ea8d22d41f5e13347a660d98688842d23ab9074767253c5218e0e39648acc4eb45e20000ea2c27de24b05d5836ffea1299a6a988eeb17a44f803a0c85aa3d9e38a3c06067c79cce66eced92ffdcbcea54e88f300d6334b8fc576b1fe421c783f51612d7e752ee749a98a7a446df5067804e0b765b3411da64cd5e644a8c1d9b400c7651c66191456903be5b06a6676876ca67773ff8823e584557614bf2c35ddaeebbc7b8c65695173e94ab381426e3484de1c55339252960acad9808cde9196d6e78edcf9b5f9010f37970c8038302699ed5124354c8cd5273bc06a346d79cf06bc5ceb977b23e6d2ac1bf03cacc388ab3f94c675f6acc76dcde972df4ce0c88553693c1a5109a643bc1be9867c222fcfed53b9f419fc938974a296f26fc94888b3a15e7481c77a2b48693416031eb7"]) [ 139.949412] binder_alloc: 11212: binder_alloc_buf, no vma [ 139.955065] binder: 11212:11213 transaction failed 29189/-3, size 24-8 line 2967 [ 139.970733] binder: undelivered TRANSACTION_ERROR: 29189 [ 139.983910] binder: 11212:11213 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:41 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffff9c, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) bind$can_raw(r0, &(0x7f0000000040)={0x1d, r1}, 0x10) 03:00:41 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x0, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:41 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) chmod(&(0x7f0000000000)='./file0\x00', 0xa6) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:41 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x8, 0x123502) r3 = syz_open_dev$admmidi(&(0x7f00000001c0)='/dev/admmidi#\x00', 0x100000001, 0x400000) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000240)={0x200, 0x0, 0x1, r3}) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r4 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r4, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x7}) r5 = accept4$inet(0xffffffffffffff9c, &(0x7f0000000000), &(0x7f0000000040)=0x10, 0x80800) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/sync_retries\x00', 0x2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r5, 0x84, 0x6b, &(0x7f00000000c0)=[@in={0x2, 0x4e22, @loopback=0x7f000001}, @in6={0xa, 0x4e23, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0xff}, @in6={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x1}, @in={0x2, 0x4e22, @multicast1=0xe0000001}, @in={0x2, 0x4e24, @loopback=0x7f000001}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1d}}], 0x78) 03:00:41 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0xff000000]}, r1}, 0x14) 03:00:41 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xa00000000000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:41 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xe000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:41 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2, 0x0) connect$unix(r0, &(0x7f00000000c0)=@file={0x0, './file0/file0\x00'}, 0x6e) [ 140.119891] binder_alloc: 11244: binder_alloc_buf, no vma [ 140.125606] binder: 11244:11245 transaction failed 29189/-3, size 24-8 line 2967 03:00:41 executing program 5 (fault-call:6 fault-nth:0): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:00:41 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0xfe800000]}, r1}, 0x14) 03:00:41 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x1000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:41 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xff000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:41 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KVM_GET_DEVICE_ATTR(r1, 0x4018aee2, &(0x7f0000000040)={0x0, 0x6dfa, 0x9, &(0x7f0000000000)=0x7f}) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) [ 140.210109] binder: undelivered TRANSACTION_ERROR: 29189 [ 140.215891] binder: 11244:11245 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 140.304668] FAULT_INJECTION: forcing a failure. [ 140.304668] name failslab, interval 1, probability 0, space 0, times 0 [ 140.316049] CPU: 1 PID: 11276 Comm: syz-executor5 Not tainted 4.18.0-rc3-next-20180706+ #1 [ 140.324451] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 140.333813] Call Trace: [ 140.336423] dump_stack+0x1c9/0x2b4 [ 140.340066] ? dump_stack_print_info.cold.2+0x52/0x52 [ 140.345261] ? lock_release+0xa30/0xa30 [ 140.349244] ? __wake_up_common_lock+0x1d0/0x330 [ 140.354011] should_fail.cold.4+0xa/0x11 [ 140.358083] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 140.363195] ? kasan_check_read+0x11/0x20 [ 140.367345] ? lock_page_memcg+0xf2/0x300 [ 140.371501] ? rcu_read_lock+0x70/0x70 [ 140.375397] ? __unlock_page_memcg+0x72/0x100 [ 140.379904] ? unlock_page_memcg+0x2c/0x40 [ 140.384156] ? page_add_file_rmap+0x781/0xe40 [ 140.388663] ? lock_acquire+0x1e4/0x540 [ 140.392641] ? fs_reclaim_acquire+0x20/0x20 [ 140.396964] ? lock_downgrade+0x8f0/0x8f0 [ 140.401124] ? check_same_owner+0x340/0x340 [ 140.405447] ? rcu_note_context_switch+0x730/0x730 [ 140.410374] ? alloc_set_pte+0x1133/0x1790 [ 140.414614] __should_failslab+0x124/0x180 [ 140.418860] should_failslab+0x9/0x14 [ 140.422665] kmem_cache_alloc_trace+0x2cb/0x780 [ 140.427342] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 140.432360] ? check_pgprot+0xdf/0x180 [ 140.436250] ? put_page+0x280/0x280 [ 140.439880] kvm_irqfd+0x18f/0x1ef0 [ 140.443513] ? alloc_set_pte+0xaf6/0x1790 [ 140.447674] ? kvm_eventfd_init+0x2c0/0x2c0 [ 140.452005] ? trace_hardirqs_on+0x10/0x10 [ 140.456242] ? xa_set_tag+0x40/0x40 [ 140.459875] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 140.465420] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 140.470976] ? trace_hardirqs_on+0x10/0x10 [ 140.475226] ? lock_acquire+0x1e4/0x540 [ 140.479206] ? __might_fault+0x12b/0x1e0 [ 140.483273] ? lock_downgrade+0x8f0/0x8f0 [ 140.487427] ? lock_release+0xa30/0xa30 [ 140.491407] ? check_same_owner+0x340/0x340 [ 140.495734] ? find_get_entries_tag+0x1410/0x1410 [ 140.500583] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 140.506124] ? _copy_from_user+0xdf/0x150 [ 140.510277] kvm_vm_ioctl+0xf80/0x1d80 [ 140.514165] ? chown_common+0x730/0x730 [ 140.518143] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 140.523773] ? security_inode_permission+0xd2/0x100 [ 140.528789] ? kvm_set_memory_region+0x50/0x50 [ 140.533375] ? lock_acquire+0x1e4/0x540 [ 140.537349] ? __fdget_pos+0x1bb/0x200 [ 140.541246] ? lock_release+0xa30/0xa30 [ 140.545219] ? check_same_owner+0x340/0x340 [ 140.549544] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 03:00:41 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = semget$private(0x0, 0x3, 0x6a) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000000c0)={{{@in6=@dev, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@mcast1}}, &(0x7f0000000000)=0xe8) getgroups(0x1, &(0x7f0000000040)=[0xee00]) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000001c0)={{{@in=@loopback, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in=@multicast1}}, &(0x7f00000002c0)=0xe8) r4 = getgid() semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f0000000300)={{0x0, r1, r2, r3, r4, 0x1, 0x3}, 0x7fff, 0x9287, 0x68c1}) 03:00:41 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x0, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:41 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xa000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:41 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x0) r1 = geteuid() fstat(0xffffffffffffff9c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r0, r1, r2) 03:00:41 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000000)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') syz_mount_image$gfs2(&(0x7f0000000680)='gfs2\x00', &(0x7f00000006c0)='./file0\x00', 0x2, 0x8, &(0x7f0000000c40)=[{&(0x7f0000000700)="46924fc2a1e54aea0fcfe45f546c84d1bd33bd7b377a1a780bb5e3ebffb151348528bf91e69e7c3410d1f80673b0afaa4cc43673cb4b9a51b2ed5d559ca994b35d7a2e61f9b4fcc9435220c625eb88094761d320c776ecb82c5ce2f6d0ae5227605cd75bb291546375778d82ce84ff882cb4c93c4779a059b95904577e4664d98c6eea28f80be42232838268ded8b80bc7136abb74df1b0b5b1bde9e9c647a5c2ddd4f88452b5a34f8b8739324b9799f9dc46a", 0xb3, 0xfffffffffffffffc}, {&(0x7f00000007c0)="a889fda0cefc911d4e0750490faad6e96e8a08fba157de1f0b42a7134120084b686035c7448b44a14ff706a866fae979befa594e06786d73cfd2610f5ef041d3bd513d8e622ba084b57981c208cb2bb89733b054ee8af7db84bd9a2b043e1e72bb29f75ba8d5080a20ed336bc20a5a0a22bc2b50b3d554176a46788a172b1b5ea980e8aca96259e9255fe0c04dc57f807e77ffa6adde78", 0x97}, {&(0x7f0000000880)="26a60e3a8466e1d70b361c1fd99544f6d022e0023558390a7569dd97a7b0a0b33dd7a2cb2ba8c14f057d36b46659fe72258a05bff478e490aa73cd600630e7daff554c855d036a987d720a2f18a434737be752c3e1fd5a6b9a8a7b9143434d4008ac5e7bfd629e11132fbe8075d4f84708c582c0", 0x74, 0x1}, {&(0x7f0000000900)="99a1455b66a6dd51b8c5bdb5", 0xc, 0x1209}, {&(0x7f0000000940)="1962e1a648c56881df27a1b99884d785f901593ca07f85c811b1b237da045f0d53b2c8dc75f31376c94bdc525ca19315e25bd81ce1855ed7c64ed9b77246d5109bf5479ba85c2105da04f5e8ca211c38e17eeaf340f87d3dbbc9e283df2a7602b2e87c50baa7a92c2162a593dc05c38be1d52e799a31165af370c7a611cbf43d83f68b6e8ef0ebb2943ef4975754b0bc028606cc01e7a96d8f9d296f7e462c", 0x9f, 0x6}, {&(0x7f0000000a00)="dc586b9bc9b4aa7fb2f4502413e85a5b9d0d98ee24a12e59bb2db01e527612aa488c74e0df462af68f90eca0d7ca4993904f81cbf761d643d597b0b5803ae0", 0x3f, 0xffff}, {&(0x7f0000000a40)="c8ef75510062c9d93ee372e83c48f7c299514089d861d421a3956e50d55a8f74ab41b032fb35407f43ac3fc5aebc762affc3df0b7db174ec615af92565d61c87886d231496ea5b51da15c21007e799e4a2a5b03debccca6325dd26b6b5e5591c5f8588f618e65ea7d070a0ac4a7c54ecef738717215b3ce54d8ffff5ab2e98b5e4ef88674486a5ce8d4909d4cca6171e159f0d8eb69a6d622aee20a051cff585413dcf335cf6b2b465ea99c1bb9e5ee1cbc316ba170ca8c2f8529a7fc2a6086fe8095e58f022b75091ec85bac585ee138a4000b9cfa5926059024aeb10d29487d8ac2f54572c8cfa798b1f97aafcff1fbf3b85610e81d9ffa1cc", 0xfa, 0x6bbcb16e}, {&(0x7f0000000b40)="87574b65890cd266a4747c5f54c6619adc0521be5223741c5b09a9fdf2802c40df24e632250d2eecc3e08aa818dfb42c1a4ef8227d9e17da4f294dba6d4c03e8b7dc2d724f006b0c542457925c80b42bda18aaf960e9c59c1da188df40094c8d8fa39187196bec6dda6e1cbbb18625a259f98da66c39f17fd4eb36ec71c6f981187b98dc64d25711a65d6572b944fcdb1a0c621ac2a0bfd31fa8f874c0a8b4f0ea8fb64fe789c5e7ef2b8667cc174d6b28a3915a1087f074c5b0872903e8fcf7380100e8bb758f5548a529e79a5e0b10416c7272", 0xd4, 0x5}], 0x40000, &(0x7f0000000d00)={[{@nosuiddir='nosuiddir', 0x2c}, {@nosuiddir='nosuiddir', 0x2c}, {@localcaching='localcaching', 0x2c}, {@quota_account='quota=account', 0x2c}, {@noquota='noquota', 0x2c}]}) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x2, 0x5, &(0x7f0000000600)=[{&(0x7f0000000100)="f5fcc311f967d1c48f40e77ab98b26444bff14893737988ead1008630a9750276367997b820b03da71418fd932e1144b9f1fab197fa51cfc01d96f192bfc5a6e860e821c26df", 0x46, 0x9}, {&(0x7f00000001c0)="bae60f5ecb714e976056237fcf0ff1b3651f5cb5a62e2d25dd893ac3a82882a9df61f6536a971abb483f12c3572fed08627acfbdd0b6b1896a2bb61bc0f0f9394777a94c3fc2cef54aa2509d46fa1a625978c3f5c5ffee92a2f6ddb591be043098d883aeeab063119a066f6dd9315d17d4210c7aa2389fdf467f4c9c0c567d77d592e6822a8ba06ca842488a3bac2d029150", 0x92, 0x1ff}, {&(0x7f0000000280)="b190a67975a5fa8bd07a37595eefcc29057d14abcd2745eee884d81f1289b781be416acaae7e9aba682c0936b9734c123494200799f4da7437edac2410ed7e879c6bddabc803f798fb05ff29aaf369593ca90cfe9d995b60c9151b0afa300dd519381c8b6ea1b20570f35d5551dfc87c62da207415900cd5b5da8602888dceb46e9de05c89c88bcf439cc5428415297342b32b2de2cd631a246b2361d7f47324ba31908d88edb68ba2e602f4e92c27a9b62ecb83a2e798830fdddda4b14fa95b474661cc26b8e524b4b1370ddb116199", 0xd0, 0x7e000000000000}, {&(0x7f0000000380)="6a7030ca26816bdb44f59a7af2c93801f04c7d3b69200cb62dd80b62e760248783b83834734395f26ed88a1ff33362ec4497073c51374dec2fb83447f0e2fe6dd83f51018320924287e6", 0x4a, 0x81}, {&(0x7f0000000500)="38f8b3ae9d60286cf5012a2dce9019aa0a0349c486f5b84859bf2addcae763a0bbec822cd4be05757d80e469b4a55261685b22427d3ad055ee21e8742d549d26f3ca05f509009d1cb6f885314b65f021664a469940f11b07efce1b331a01da9b8bc0c567421baee9c09360dcf6a7035ebd06202d4eb3f4ba0714ae7866c38ace7a579a9020bb0affa7b4e910f928f484110f0b0f0783f654165ccea7e1db4f2b3c12a5cdda1756527f8cd842d95adf6433b99a9c5d18488dd0dd930770c3e2842b790a3944c30a31fefdf4c28609b7a1d5e767203ccda6271152d990ad644a52ad", 0xe1, 0x80000001}], 0x2000, &(0x7f0000000400)={[{@grpid='grpid', 0x2c}, {@logbsize={'logbsize', 0x3d, [0x32, 0x30]}, 0x2c}, {@nogrpid='nogrpid', 0x2c}, {@logbufs={'logbufs', 0x3d, [0x3d, 0x0, 0x37]}, 0x2c}, {@sunit={'sunit', 0x3d, [0x37]}, 0x2c}]}) 03:00:41 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x2000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:41 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000000140)='./file1\x00', &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000001c0)='hfsplus\x00', 0x900008, 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000040)='fuse.', 0x0, &(0x7f00000000c0)="462903650849008b327804d1f18b601b9fbd82ed7da16b701a74e6ef725c07bdce365bc43fa89c2e6da9bb8adb3919a1304d6d5964c0e4c7fa9c6185a1b8835b4366d9d63c6b0eb28a4ae68ac87709959305ab1538aa7f426b0b22a247a362a114df99edc8f3473f6f20c09e06") 03:00:41 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x9, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:41 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x2c2, 0x0) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000040)) 03:00:41 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x400000000000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:41 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) openat$cgroup(0xffffffffffffff9c, &(0x7f0000000180)='syz1\x00', 0x200002, 0x0) syz_open_dev$sg(&(0x7f00000001c0)='/dev/sg#\x00', 0x7ff, 0x111002) r0 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)={&(0x7f0000000200)='./file0/file0\x00', 0x0, 0x8}, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000380)={{{@in=@remote, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@rand_addr}}, &(0x7f0000000480)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x7, 0x9, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@alu={0x7, 0xe8, 0x1, 0x9, 0x0, 0xffffffc0, 0x1}, @call={0x85, 0x0, 0x0, 0x37}, @generic={0x8000, 0x0, 0x8, 0x5}], {0x95}}, &(0x7f0000000340)='syzkaller\x00', 0xe1e, 0x0, 0x0, 0x41000, 0x1, [], r2, 0xf}, 0x48) r3 = dup2(r0, r1) r4 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r4, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000900)=@newlink={0x28, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r6}, [@IFLA_LINKINFO={0x8, 0x12, [@IFLA_INFO_SLAVE_DATA={0x4, 0x5}]}]}, 0x28}, 0x1}, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e21, 0x1, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x14, 0x13}}, 0x8}}, 0x7, 0x4, 0x8, 0x2, 0x28}, &(0x7f0000000000)=0x98) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r3, 0x84, 0x78, &(0x7f0000000040)=r7, 0x4) syz_open_dev$sndpcmp(&(0x7f0000000280)='/dev/snd/pcmC#D#p\x00', 0x1f, 0x10c01) [ 140.555086] ? _parse_integer+0x13b/0x190 [ 140.559246] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 140.564786] ? _kstrtoull+0x188/0x250 [ 140.568586] ? _parse_integer+0x190/0x190 [ 140.572736] ? lock_release+0xa30/0xa30 [ 140.573646] IPVS: ftp: loaded support on port[0] = 21 [ 140.576705] ? check_same_owner+0x340/0x340 [ 140.576722] ? __check_object_size+0x9d/0x5f2 [ 140.576741] ? lock_acquire+0x1e4/0x540 [ 140.594660] ? __fget+0x4ac/0x740 [ 140.598290] ? lock_downgrade+0x8f0/0x8f0 [ 140.602449] ? lock_release+0xa30/0xa30 [ 140.606438] ? pid_task+0x115/0x200 [ 140.610064] ? find_vpid+0xf0/0xf0 [ 140.613606] ? __fget+0x4d5/0x740 [ 140.617059] ? ksys_dup3+0x690/0x690 [ 140.620777] ? kasan_check_write+0x14/0x20 [ 140.625672] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 140.630602] ? fsnotify+0xbac/0x14e0 [ 140.634316] ? vfs_write+0x2f3/0x560 [ 140.638034] ? kvm_set_memory_region+0x50/0x50 [ 140.642615] do_vfs_ioctl+0x1de/0x1720 [ 140.646501] ? fsnotify_first_mark+0x350/0x350 [ 140.651082] ? __fsnotify_parent+0xcc/0x420 [ 140.655404] ? ioctl_preallocate+0x300/0x300 [ 140.659810] ? __fget_light+0x2f7/0x440 [ 140.663781] ? fget_raw+0x20/0x20 [ 140.667231] ? __sb_end_write+0xac/0xe0 [ 140.671206] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 140.676740] ? fput+0x130/0x1a0 [ 140.680021] ? ksys_write+0x1ae/0x260 [ 140.683825] ? security_file_ioctl+0x94/0xc0 [ 140.688235] ksys_ioctl+0xa9/0xd0 [ 140.691679] __x64_sys_ioctl+0x73/0xb0 [ 140.695548] do_syscall_64+0x1b9/0x820 [ 140.699415] ? finish_task_switch+0x1d3/0x870 [ 140.703890] ? syscall_return_slowpath+0x5e0/0x5e0 [ 140.708809] ? syscall_return_slowpath+0x31d/0x5e0 [ 140.713724] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 140.718721] ? prepare_exit_to_usermode+0x291/0x3b0 [ 140.723717] ? perf_trace_sys_enter+0xb10/0xb10 [ 140.728713] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 140.733536] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 140.738717] RIP: 0033:0x455e29 [ 140.741889] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 140.761069] RSP: 002b:00007f7d5f9bec68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 140.768755] RAX: ffffffffffffffda RBX: 00007f7d5f9bf6d4 RCX: 0000000000455e29 [ 140.776019] RDX: 0000000020000040 RSI: 000000004020ae76 RDI: 0000000000000014 [ 140.783282] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 140.790542] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000017 [ 140.797798] R13: 00000000004bdf94 R14: 00000000004cc800 R15: 0000000000000000 03:00:41 executing program 5 (fault-call:6 fault-nth:1): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:00:41 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xffffffff00000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:41 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0xff00]}, r1}, 0x14) 03:00:41 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x3f00, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:41 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0xfffffffffffffffd) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760100") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) [ 140.815490] binder_alloc: 11291: binder_alloc_buf, no vma [ 140.821096] binder: 11291:11292 transaction failed 29189/-3, size 24-8 line 2967 [ 140.852941] binder: 11291:11292 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:42 executing program 3: r0 = dup(0xffffffffffffff9c) ioctl$TIOCSTI(r0, 0x5412, 0xa7) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x400000, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00005befdc)={0x0, 0x3, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}) ioctl$TIOCSBRK(r0, 0x5427) r3 = syz_open_pts(r2, 0x20201) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r3, &(0x7f0000000140), 0x28d) [ 140.860830] binder: undelivered TRANSACTION_ERROR: 29189 [ 140.870545] device bridge_slave_1 left promiscuous mode [ 140.876125] bridge0: port 2(bridge_slave_1) entered disabled state 03:00:42 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:42 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xfd000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:42 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xd7fe, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 140.918532] device bridge_slave_0 left promiscuous mode [ 140.924089] bridge0: port 1(bridge_slave_0) entered disabled state [ 140.999811] team0 (unregistering): Port device team_slave_1 removed [ 141.012406] team0 (unregistering): Port device team_slave_0 removed [ 141.023376] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 141.035949] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 141.055515] bond0 (unregistering): Released all slaves [ 141.077916] binder_alloc: 11343: binder_alloc_buf, no vma [ 141.083533] binder: 11343:11344 transaction failed 29189/-3, size 24-8 line 2967 [ 141.091569] binder: undelivered TRANSACTION_ERROR: 29189 [ 141.098249] binder: 11343:11344 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 141.524630] bridge0: port 1(bridge_slave_0) entered blocking state [ 141.531006] bridge0: port 1(bridge_slave_0) entered disabled state [ 141.537998] device bridge_slave_0 entered promiscuous mode [ 141.566949] bridge0: port 2(bridge_slave_1) entered blocking state [ 141.573331] bridge0: port 2(bridge_slave_1) entered disabled state [ 141.580453] device bridge_slave_1 entered promiscuous mode [ 141.600178] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 141.620723] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 141.672875] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 141.694943] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 141.775123] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 141.782205] team0: Port device team_slave_0 added [ 141.801440] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 141.808639] team0: Port device team_slave_1 added [ 141.828860] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 141.849913] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 141.870549] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 141.891778] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 142.054606] bridge0: port 2(bridge_slave_1) entered blocking state [ 142.060965] bridge0: port 2(bridge_slave_1) entered forwarding state [ 142.067551] bridge0: port 1(bridge_slave_0) entered blocking state [ 142.073899] bridge0: port 1(bridge_slave_0) entered forwarding state [ 142.663864] 8021q: adding VLAN 0 to HW filter on device bond0 [ 142.726282] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 142.786236] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 142.792376] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 142.799641] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 142.856733] 8021q: adding VLAN 0 to HW filter on device team0 03:00:44 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x297, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:44 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:00:44 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x900, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:44 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0xfe80]}, r1}, 0x14) 03:00:44 executing program 6: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x10000, 0x0) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000080), 0x4) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000040)=0x1ca5976a) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000100)=0x80000000) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:44 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) stat(&(0x7f00000000c0)='./file0/file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffff9c, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_fuseblk_mount(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00', 0x2000, r0, r1, 0x8000, 0x80, 0x0) r3 = dup(r2) getsockopt$IP6T_SO_GET_INFO(r3, 0x29, 0x40, &(0x7f0000000200)={'raw\x00'}, &(0x7f0000000280)=0x54) 03:00:44 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) 03:00:44 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:44 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xef4b7c9b, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:44 executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x1) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0x109000, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) tee(r0, r1, 0x1, 0x6) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:44 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x80fe]}, r1}, 0x14) 03:00:44 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xffffff97, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:44 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0xc020660b, &(0x7f0000000040)={r3}) 03:00:44 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x3) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = accept4(r0, &(0x7f0000000180)=@sco, &(0x7f0000000240)=0x80, 0x80800) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f00000002c0)=0x11461ca1, 0x2) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00005befdc)) r3 = syz_open_pts(r2, 0x20201) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x80, 0x0, 0xc3d4, 0x1}) write(r3, &(0x7f0000000140), 0x28d) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x2100, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r4, 0x2288, &(0x7f0000000040)) [ 143.231402] binder_alloc: 11626: binder_alloc_buf, no vma [ 143.237052] binder: 11626:11628 transaction failed 29189/-3, size 24-8 line 2967 [ 143.251236] binder: undelivered TRANSACTION_ERROR: 29189 [ 143.257199] binder: 11626:11628 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:44 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:44 executing program 0: r0 = syz_open_dev$adsp(&(0x7f0000001a80)='/dev/adsp#\x00', 0x79, 0x3c002) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000001ac0)) r1 = accept$packet(0xffffffffffffff9c, &(0x7f0000001980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f00000019c0)=0x14) getsockopt$sock_timeval(r1, 0x1, 0x14, &(0x7f0000001a00), &(0x7f0000001a40)=0x10) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000001680)='./file0/file0\x00', &(0x7f00000016c0)='./file0/file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001900)={&(0x7f00000018c0)='(\x00', 0xffffffffffffff9c}, 0x10) ioctl$KVM_INTERRUPT(r2, 0x4004ae86, &(0x7f0000001940)=0x1) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000015c0)='/dev/vga_arbiter\x00', 0x10000, 0x0) getsockopt$sock_timeval(r3, 0x1, 0x15, &(0x7f0000001600), &(0x7f0000001640)=0x10) syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f0000000040)='./file0\x00', 0x8000, 0x5, &(0x7f00000012c0)=[{&(0x7f00000000c0)="aee9d88d52eb6e634ec1e4fc322d2a786bdf0debf0923d", 0x17}, {&(0x7f0000000100)="862075f1d0d6dabd5203a027874a412683d8801f211c3ac20c072a7200b4be7435ffa3d53b80b4210ade78940cac8aae22e4bc59292670a856eabd7f215c5e786f7819ff2f31af93cfbf2ce7b26d2fe736aa5fb4deb5bdd6a1e9aa26d6d79d1575da7a39e42732529ead518c0bf97403dee1845699c9aed07ab2511559da94b39e6271657c321fe460823540b53546f0d7a3f1448a2ea30d63bff23e33bb153ef5238dc22acd0fc17e34330db10d87", 0xaf, 0x5}, {&(0x7f00000001c0)="ba5e15f2445d68dcf700dbbe6c4546ffcb8c16721ccb2257cd3ca702ea99e3686ece401622ff391853ffc0474c11706a0f58ba5e20e72afb2d36c0eb05c294fd0e2e895526c858e56150371211217879915d1e178d4aaae54795573fe1bfcb109930abfb0fc4075c5badb966c035057a5037c969802768155099cc716e028cf0316365b622449851953c86b9e4083f69e09f0c7fadae794710feb7f3c3e76938340057f0916ca18613f925dd0be50e2629b82f6d0d3e4aada08d5b4d3ff358a662d06fb654a00f4ec6d41a4f174a0cc160b75ab681b523cd556c8697d5244a018c486372c1d4ca53580201debe900b0b630bb888bb768ba724e808ca41ee1d49c14c00a68f2e0f921318a57dd4c2a2d5614fef11ee9481fe1cb96440414f2aecb286910e0c9ed3024366e6d09047256044281e449798dc78ae503c0ad3112249322ab57f58375cd7d3ab3f5ca2d5c4cc08688cf0d9f6b965db4eb5cd743db2fbe30b9f3154f7e97be468103161b62095b6b251d080f68ad3997a10bcd974965ac70bb273b0b2ca933642e94a881ceb647e844fd31970057d4ec86ab13250e84d54d0314a8652df8f74bf84d868b5b83f12f1525a90b9f3ebc83a7dfd5d2a072a61ebc43798803eff6b14c25af0152ed95a84db4d2ee8acbbd875f6fe0c71733331080e447300d77f2ccedbfeb0d5537cb11f17229fa88737834038ac3e726ec0c939ada133e24c63453a5ee3457bd2447b14ebaef81b39090716f686012b5c6c8432c9a26304ee5c93cf57c6b1a6cc5d0c97e713444d530848333d89c2d5d15303518bde36d5cc978dec465f98963cf059f4a9eab366e9695ec03d5f8f47d97e2b1e5ad04d42d3b166b60c2112bb3c7d87f97ebcfd774fb7b88c6afacb451f8f64f6c974d0b90fddd359c15dcd4adfa5b38269d25adaadf7c9f62dee0c1d1afa9207da759b725667cd85da7bd2abc97aab72e8bf9431382625cbfe669734c55170beec621f98154f9881a13d3262a558622a54455e00968f983886315d7d06603dc03afe92c73a42f85e2edb074cda53d33e88bbf2ed48e77ee3c29fe61a0e877c0810a88f402f9a31a91d43924c999779f9a7bbdf7d8fecf0a0879ed79e213515ebcb3f4e086a00dd21660ed10eecbc23dee94a5887d243c81a662debfba858a56f09a8e80ea1ac0b4912fb19cde0345fbcda4754c27df18095b7874db5dffe3c599a3818c2f9fc81033e1221311d3bcd1b304965cf41ef6acaf74e713da7ee0318088a5ad079921d9e5cfa41f0a563b7833b600cac31bd2e0f64956ef09312cf6901c109b6b280a30853d0c4d0e923621ef8b36c55d732b683524fb885a6ad854ba43db77ead1c8e35fd601db7c97c04c18e6c58aa6baecaa93e7ab2c8bd6c63149e05f72993ccd181820e4d48e184e48c93546e9845880a630f612bef992e2405880e0dd27dbca603bb2a559f5a2079ce63a062832cf7d5aea67b6e9977fa833d30403b1e7cfa01b2fb78b305777cb9f039f928fbc34275d420727f44421ec431225d4b2f06fe12a41917023f775978bd92a8516f4624ec43f5516e888eaa6e0c5e0d29a025c22bde79fc0220fa5b122807935452cc0012788a3f3e7e9ea16e97bd944d532bd5bec291a8f43d9ab486eb2c4cd7add9c1c65a281fd01243a9b542617236d943beaa746ffd2cabe1ec067853b428f3201041e068e2179e4f1542bdef46f53f063de9c2a4650af5022da60407a1b4063566a8f92fc8a53c462e72cd355e2567873e088b060cc4926d71eecce7f9e0a5205dc2fe708e2b6843748cbe012fc6c5ff130ee5dee20cf56945a10cc51c4046f9a288a569525f1af1cade6531833977d3c57976ecd8de14f2d925d7838f40d1ad143287e358f5b966b43cf3eecbc1623ebca0a4af27be5998165c4ced144a931684e1d444ff3210c7f461886521e9800a77cd0a87879d081f07a316c73e8ab88d1563b37c509a24551046dd67569bbe52a92278865b4e2b3ac17f58e2161b2097f3ef25ef7da49d9640249093145b785ae40bd95641ecb147a3658f89b534b3cac35461fcbcb30ba91e46a1b16c7722efa1147ff38a1434d91c3072065415372e7008e01016a2b2e40646af8e61712e99520505f471b94b9ffeb1ae2e420a5725b64e6c2175fd58a43cdbf08ef1af9226c36615cf345f158ca59284726d859ef7b69661349767b3a2ef9045497c9bee6288d88606860a2896f58b6dd2892da4259d6eb8f09ea19b8155edc3dd7bb8d49d7e96b59531a1d73e4a41d0485d6307eb481fb005db165887bd1ce55bfbe7c750bd879dff999f8c3140c3c429c8a41578df267485f6211402a345d456035c07b38fc85f2b305612a00e007fd78f525f00c77d42eb05a09149fff3a2b52d45211ea998083df2bc1bf60efdb638e483a19d4627012ac5c97b5bb6afc39db3565a76f5a2ce5effdcad67bc464e3405bf432201199fbf3108b2d648b4ed0654a7400ced339a8805533d666af172fc660f4bef60ad2d24c483fdf455411320641b4e16cf2bbd694e20de44aab52fa5b7e4d0a268a4cef8e6d2ae2ace6282ca68ad8bdce0783bc63f8c6ae149f398e6fe83d0540b81084eacc3515709c2c1cbf7f1b5e32d2974c4b5300e0d7022d5bcbd20d9315f7d0643c19ae54bca0942000e23631afa2efe9212d0809e28c9e1029c41e06ad963f1ef5eb3905610a5f447623f77daf155134c630a13ee277ac86497d40a1be616acb821eabcc7dd01ef4b99f2901ba16c2d69aa5f39a7a54be1b7ffc15ca6ff7edc086f038310579763d822648d196b50af89c8cde983ffcc7701286be470d9a81f1ef82332bdad99ada4cfc412ed447aa0fa0e5c427456a0960321743e34fb1223172ca2ea7d8bfa858657de692ffa39036e1175cba05ae5cbc85518e6116b31287a1d5ac9fc8b4c669b1dd9d371b7e897580d1baccb5a4069d6e09fdbfce5c1895169f1707027f882fa572c1d225911757908f7634f08b7f103d54f166b319a4ae9c10dd44be861b0c66c4f479c97754c3ba2d6278ade4f7bb085ad1a19b15b6395fac572702e6e135e9d8aa468435f6978fa874a85e27d777d7407651448a946b1eeff8b69dcea58441c6b7289b29bacde59f8290708ad4a4daea0ded93b5271088002e7f6c38aa7dc9ec7111a2e9d7d75a7fc35c3d31cc12b7d37dc6d40dfd6a5aadcd08cc8d4237b5e2f1f733838d44f740bc440be2d713cf72ec4da6b8765a59b9fa64168f855c4494392e8cd045015d34898f97a4133690af97cb057fc64c9378dd181501d827e1faf8edcb4398f2757cac18542d9816c5b61fcd58b56a7c961bff2f47f4847be7e21acc82f7f4a8fa5a758db629af4e809a31c7dcf873639fd05ecb8911bd7561f2465e697ef049909a0527f01170668aa3cf2af41666d330e5101f5ed601ae45e108afb92ec22a22264a6bc63c65412e16ddfb0e94bae163b4cde5348a3486f6f29eb923ebd6dfbe2fd0dfc8bb1a71564f69dd206b8df6d783f44f4104bae587012bbd8083ae584d901a110c0a58c441e7e32ea7e1f8ddc2937524569c764236af512cec3532c3aafbecaf7079138ba50684b0689e5f0f53a31d2a142ae790a2f884a664699f00f05d4474b8d49af5585a6e99266a90cc0195659f090dd1955ce9813e70106852c972110d04ec71fabea031f6885d357884b89886f1ff07e50306d4e404f2b51b626a3344895154c6832bd56a7db529776328f24e3d5e7214cc773d217b7d3f547afc8a5469d5ce42c6e0536d017bf6921f3d39cddcc67b324417eaea997d9bf7a4fbb1c5b365737fb84390d6fbd1b3e8c9492d5ceb5e5c0ac3efe9038c15ec5b60d9f9be70a39a71ebf86951d2d88a62f09b749f65d3c771365ac92344753f482449fca22438cfc33068b2b6c346bcfdf4a4c71cf7ed3032acec3e6754ae898876373bc35c3e045d92bcf095b7709051a3a3b27a6e25fd55526c2f1fda136c34aee6338da4e8cfc27ab0d6186b9b8a17112eccb0ad635264d1d97c0172fe41fb3bc4e1a2c0c5108978dab0553c6d7ab300967add9a471427edb0a7658a15923cc9310c9479d902d757ff548bac8b4d1ec55cce59c40ead996acc5a623ab2c686abfcb889e2509512c4543242a131b9c2dd5804af56420da04dcfde1ea0aa7e7c1ecb459dfb64dd30f853d5339003fa2203a41af9ba47d15b61c30023cef07abe433ec6d3769a9cdca4f5b7c5fc0f798c2bbfa572c03e28fc742246c2c0c3121b0d05b374a0e63a42250575bd39bb58702d34695b7835e715a449087bd59560ef243f108d596d2e6e497ad73d0c1f8fed3d342c705d90c50b40316624818e505e7174737b3588a743a4bc395f8b680a43c8a32574825fde56d3966e569c09e3c7b72b3fd8baf637944cb4f813e37bdc048ea0f9483f47175738c9f79c8a7f2125beed45fb46adc2c92e62610003d924f5dfd65b10cf6169b5cfdca5b8e53b9c4d6c19c1873e6f0405f3c95580cccb8ec81c118bb197c3e5e20c4592a25309848344ee55098bd84ccc507fc6666bd622f324a752378cf349e047dd47ea36451f6c9c36f8a44b1f1e6487472d8de8f867edd7457d0431f8af6953e21723333b53f478b6040f589e80ffecd78f584ec765215836d3903b2c288e6a1fe01f3ad5a30d7bdefa2cb0fbb59f59451ff44d997e3a28519bfbdba577e24e327e6342e87ae0c726f29d23f812b0f3a98338fd0bf150f9f603d94efd09ed9e7def8dd4caa03e8dc54559bd52130ebf965d319d5907d86c7e4837b5fb38d4808b2c5cb26cf4423bba74457643a4aa14296fbf1d2ad0d4c96167b421440325255d823b13601dd3dc1363f0098f23e46695f501546f42ad6c38ca7efa80c3d5df6fcad88f0ec6ba9d0dc45c86b85d6eccbcaadf1fddcc8519bfcbef50a0002a7cf7e5408c0e12ec24314bcc109fcaa1ef9c58e4658353e4b96a90cca2f8b87920e1a95840af7f13ea8fcf6f54c71b63cd8624c854fd0e314c7d556a41663ececfbae63ff2bd3373ec9dd4cf05186d10d24f43701334f7a6b196d8a464924717525968eee4c847b168ff35129678822ce7f5f87a62cc7496906ca9c2db4cf486d34a7c540c0f26fe56ad6ab4bf894f2ee3143b29392d3add62e710bd8f9467b757c80222c70e382c177d0b91a4e459725f57b8287c425a3186583ad1e64b5ef4db7a4de13d7d8942493cdc9d3cc887b7d15ead1da32da3e6770187e65fd7e5f77ad4fc810b383709d89c0185753215109ac783be545b13456b8655f3939e0f8628c459354e30f37b725fab029d23693e9cddf7f929a0f3f2c27f420b3d7a459a7e85553e1ff1c0c00e8af1cf2bb6feac3286626623cf779b25663167234ab917b9503887c1e980432f9186e1329e228f4e8621521615b0681b4ed561c24ef8a4ee2a2989c5329193edaa3b23c37306de6e8fd741d75ca61ef6d5f3670b35e1d60f0f293ba5c6b0ed5ca46c02515c4cd15e6292cb1b61308f352a4d95d0d807a93ed33365fedc3ab6bc5d13d1b93533b0fc67bc5fcc4538607da378e7472cd6a7a4ddcb0b10e723116878f55ec9f8fc429e6eb34aed2ece73385d162b8a36a62625b0dc81d8535c31abbc5b454862e6958dd80699ea0300937810d3c770ae16959bc724462b58ad4f0fefdbdc47483813af887366601f05ccecda03cc46a0488e9c2f190b594784d006267f4b9a515ebc206396a9ad62af2cf8c909fc4fef8cce1c0d6ef174ea7a04a8e9c2c81f70a985d4642f48559e7e99f2eb80d7814", 0x1000, 0x4}, {&(0x7f00000011c0)="d502901d499670ae5f19cf0d831370e9f0d19175b0e7e66ee2c7bfc37b007e817f14660809ec645483e26a9af6c33c78e38b3f80d6aa20ebd68901b0c9c44a295785ee52d1d09f942be3df8e9e8824346aae672ec4d95017874005c960a6546a1180406915fa2b60f5fc", 0x6a, 0x401}, {&(0x7f0000001240)="58dc37e124bc0abbe8fdf9d1ab2cf4a142d2520a301d5b4c955994a50da05bf1320bf28cc79eae9b02a3e5d900add98223f281083b278bbca2075fd43ff9088758a23a73ab1b217963d139dfd69b0d3e9615f09c9674094de5819dd493ccc38fd2e0bd18e1cdf237058d9811cf4a1d1d46c87c90a4e8f2e64f", 0x79, 0x5}], 0x100000, &(0x7f0000001340)=ANY=[@ANYBLOB="6572726f72733d636f6e54696e75652c756d61736b5d333332313033301d646f747300"]) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000001740)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000001700)={0xffffffff}, 0x13f, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r3, &(0x7f0000001780)={0x15, 0x110, 0xfa00, {r4, 0x1f, 0x0, 0x0, 0x0, @in={0x2, 0x4e24, @multicast1=0xe0000001}, @in6={0xa, 0x4e20, 0x800, @mcast1={0xff, 0x1, [], 0x1}, 0x8}}}, 0x118) syz_mount_image$ceph(&(0x7f0000001380)='ceph\x00', &(0x7f00000013c0)='./file0/file0\x00', 0x6, 0x2, &(0x7f0000001540)=[{&(0x7f0000001400)="b2f6982bda6b8ab38b7006bf26bcb91a6d2d704121c08894c8a509678c8d4fb8adecb25e1b72e0dce130d774319c14531af58bdc6d8fdf48872da67ea149d1ce88fee422fd5de208a93525f6e48e2bdbc62946c7dc6c8d1e9c9ed1c3cae33201d6126a619ffc712d082accb996af9958271d543b84f0087ab86f2ac9c898bab03e8db72514856efa25ca9bc1fe4f1773b048ddab9cb151f853ed9c83cd365420a15e6a197b6eeb4e277e4a89cd1cf2d450a9beec9d5e70bf9d", 0xb9, 0x7}, {&(0x7f00000014c0)="e9e42a64abd84098c9f15f6cb0d7a44be43890d64967a7647d33411fad3270c99bf0357d2f43012813fead1eeffec8d7221e9343c1d23f306516d8a7fb9984ce92c7d12c71edd1127e65", 0x4a, 0x2}], 0x800000, &(0x7f0000001580)='vmnet0ppp1\x00') 03:00:44 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mlock(&(0x7f0000ffe000/0x1000)=nil, 0x1000) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:44 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xe, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:44 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0xff00000000000000]}, r1}, 0x14) 03:00:44 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xd803, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 143.420718] ceph: device name is missing path (no : separator in /dev/loop0) [ 143.432666] binder_alloc: 11676: binder_alloc_buf, no vma [ 143.438296] binder: 11676:11677 transaction failed 29189/-3, size 24-8 line 2967 03:00:44 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4010ae42, &(0x7f0000000040)={r3}) 03:00:44 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000000)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x7fff, 0x2, &(0x7f00000002c0)=[{&(0x7f00000001c0)="20e3d1b100909005fdb868f1bc78f5b027a9d44d1e1f81d1d2b58ea4f2e8dcd2d201e514632231809324ef64c4341d88bcc1c86ae2c8fc62b921d79a79d052abffa03c4b1635af51d177338d68f9365df7bde7c3e5eee0dc5892c6755e3d3084b1c6bbb98c9b1a70e69fbcb4f2dc2d0e3f7bcd4947e6ed540e6552864a62cab1333af01a9d769d8bff1e5375e64d77bb6a3a84e05a0ed623c54f97e63b00bb020ee44d35882d6926dc827bfd60491ab211ae0c515dbbe3220046a9fc9700048425f85334815f1a892a0f948f", 0xcc, 0x180000}, {&(0x7f0000000100)="840016ad0ca96f9aa89277c79c3df31e6da93c1201e62b4025ba80a54acc35d68410afe87489771e50b01c9a492c0bcb29cabcbc0adbd6dde438594d910b8c61ba877419da8410b4574584c716cc1e51ad72e6e26cafbbb062440b51ef2e0b8e1255a25dc07349d696", 0x69, 0x1}], 0x1, &(0x7f0000000300)={[{@force='force', 0x2c}, {@nodecompose='nodecompose', 0x2c}, {@umask={'umask', 0x3d, [0x36, 0x33, 0x32, 0x31, 0x37, 0x35, 0x34]}, 0x2c}, {@creator={'creator', 0x3d, "e904f86c"}, 0x2c}]}) 03:00:44 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0xd0) mount(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)='./file0/file0/file0\x00', &(0x7f00000000c0)='efs\x00', 0x1000000, &(0x7f0000000100)="c8fec00692660c14129d10145f4359201351e4f2651d090480ebccaa90424cf1fc7e3185ca177d9d99d6086f41603b2c81432adf38daa6d32b84dbe39b56c803af2b0ad0247d96d431ac8c5ee26e9256942edfc6247fed65b89da9f18dfd6ef29857a1dca0915a5cc13410d0e6f26eb9590a3562d7130bca56d9164021d5094447547ca7692fe8d7663881f8390d621c") clock_nanosleep(0x2, 0x0, &(0x7f00000001c0), &(0x7f0000000200)) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:44 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0xfe80]}, r1}, 0x14) 03:00:44 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0xc0ffffff00000000, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 143.528399] binder: undelivered TRANSACTION_ERROR: 29189 [ 143.534458] binder: 11676:11677 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:44 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:44 executing program 3: r0 = socket$inet6(0xa, 0x1000080000002, 0x40000000000002) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) write(r2, &(0x7f0000000140), 0x28d) 03:00:44 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x1000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:44 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x5, 0x80400) bind$unix(r0, &(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:44 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='./file0\x00') 03:00:44 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0xc0045878, &(0x7f0000000040)={r3}) 03:00:44 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x80fe]}, r1}, 0x14) 03:00:44 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x2, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 143.696778] binder: 11727:11728 transaction failed 29189/-22, size 24-8 line 2852 03:00:44 executing program 6: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x101000, 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r0, 0x4010ae68, &(0x7f0000000080)={0xd004, 0x100000}) 03:00:44 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0xff00000000000000]}, r1}, 0x14) 03:00:44 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x10, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:44 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000003f80)='/dev/qat_adf_ctl\x00', 0x40, 0x0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000003fc0)=@assoc_value={0x0, 0xfff}, &(0x7f0000004000)=0x8) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f0000004040)={r4, 0x4, 0x4, [0x400, 0xffffffffffffff80, 0x0, 0x28a5]}, 0x10) 03:00:44 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0xd) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f00000000c0)="46ed26030ce0cac6ffd0e2848a9dedc6a5275fc5f4491ce8cbe963974c47a18e58028925a12360c07a312e0c634e0daa5a281c1ecb58d7589f21df9ad528de5342") [ 143.753805] binder: undelivered TRANSACTION_ERROR: 29189 [ 143.759707] binder: 11727:11728 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:44 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0xc00caee0, &(0x7f0000000040)={r3}) 03:00:44 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:44 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0xfe80000000000000]}, r1}, 0x14) 03:00:45 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x970, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:45 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x4, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:45 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2000000802, 0x0) connect$inet6(r1, &(0x7f000000cfe4)={0xa}, 0x1c) sendmmsg(r1, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000480), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000029000000370000000100000000000000"], 0x18}}], 0x1, 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:45 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:45 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{}]}) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) memfd_create(&(0x7f0000000000)='!:bdev\\cgroup),trustedem0cgroupproc]$vboxnet0\x00', 0x3) [ 143.901851] binder: 11781:11782 transaction failed 29189/-22, size 24-8 line 2852 03:00:45 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0xff000000]}, r1}, 0x14) 03:00:45 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x5450, &(0x7f0000000040)={r3}) 03:00:45 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x9d8000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 143.979335] binder: undelivered TRANSACTION_ERROR: 29189 [ 143.985113] binder: 11781:11782 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:45 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0xfe800000]}, r1}, 0x14) 03:00:45 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:45 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x400002, 0x0) ioctl$TUNSETVNETHDRSZ(r2, 0x400454d8, &(0x7f0000000240)=0x2005) r3 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) r4 = fcntl$getown(r0, 0x9) move_pages(r4, 0x3, &(0x7f00000000c0)=[&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil], &(0x7f0000000100)=[0x8, 0x8, 0xffffffffffffffff, 0x73, 0x1], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2) write(r3, &(0x7f0000000140), 0x28d) 03:00:45 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:45 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x100000000, 0x40000) 03:00:45 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x143) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000000)={0x0, 0x16, "816311957893bbbcd713a3fa511e5f22be4e16e20da1"}, &(0x7f0000000040)=0x1e) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000080)={r1, 0x2db, 0x6}, &(0x7f0000000100)=0x8) r2 = socket$inet(0x2, 0x3, 0x3) sendmmsg$inet_sctp(r2, &(0x7f0000002c00)=[{&(0x7f0000000140)=@in={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10, &(0x7f0000000440), 0x0, &(0x7f0000000500)=[@dstaddrv6={0x20, 0x84, 0x8, @local={0xfe, 0x80, [], 0xaa}}], 0x20}], 0x1, 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:45 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0xc0045877, &(0x7f0000000040)={r3}) 03:00:45 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0xff00]}, r1}, 0x14) 03:00:45 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x8cffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:45 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 144.134400] binder: 11821:11828 transaction failed 29189/-22, size 24-8 line 2852 [ 144.159841] binder: undelivered TRANSACTION_ERROR: 29189 [ 144.166508] binder: 11821:11828 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:45 executing program 0: r0 = socket$pptp(0x18, 0x1, 0x2) mkdir(&(0x7f0000000100)='./file0\x00', 0x4) poll(&(0x7f0000000080)=[{r0, 0x3}, {r0, 0x1000}, {r0}, {r0, 0x2000}], 0x4, 0xff) mq_unlink(&(0x7f00000000c0)='fuse.') mkdir(&(0x7f0000000040)='./file1\x00', 0x3f) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000000000)='ecryptfs\x00', 0x4, &(0x7f0000009000)) 03:00:45 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) write(r2, &(0x7f0000000140), 0x28d) 03:00:45 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:45 executing program 6: getresuid(&(0x7f0000000040), &(0x7f0000000080), &(0x7f0000000100)=0x0) getresgid(&(0x7f0000000140), &(0x7f00000001c0)=0x0, &(0x7f0000000200)) syz_fuse_mount(&(0x7f0000000000)='./file0\x00', 0x1, r0, r1, 0x2, 0x2) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:45 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0xfe800000]}, r1}, 0x14) 03:00:45 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4010ae67, &(0x7f0000000040)={r3}) 03:00:45 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:45 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x70090000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:45 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0xff00]}, r1}, 0x14) [ 144.305474] binder: 11867:11868 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:45 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x230082, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) 03:00:45 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:45 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='./file0\x00') 03:00:45 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:45 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x5452, &(0x7f0000000040)={r3}) 03:00:45 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x1f000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:45 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0xfe80]}, r1}, 0x14) [ 144.473735] binder: 11897:11899 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:45 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x800, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r0, 0x5386, &(0x7f0000000040)) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) openat$ion(0xffffffffffffff9c, &(0x7f0000000540)='/dev/ion\x00', 0x801, 0x0) mount(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)='autofs\x00', 0x8000, 0x0) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000180)) syz_mount_image$hfsplus(&(0x7f00000000c0)='hfsplus\x00', &(0x7f0000000100)='./file0/file0\x00', 0x1, 0x7, &(0x7f0000000480)=[{&(0x7f0000000140)="4b4f34b90e9d330accec0625c0137ecd52b4a31fbeacef0613ebe0e1c82e837d4cb39b57c1569cf1f437ac01597d", 0x2e, 0x6}, {&(0x7f0000000180), 0x0, 0xe39f}, {&(0x7f00000001c0)="ed556ab96a9da70fa03bb0c575f720611441cc87a8b59aab88a79c25ff1010470c49db75fd7b747e236f6f7dfcf597c838b74ca18a889f8e894fc034f23284a60e000bfed9e2a4ea1fb18f39b83c64a199a4adfd5290e0fe16b912d19a50ce585121f0b51ebe4663c0e005152c135d94146acbe7def7dd86d6b70c69d1e6b26038c6656e2f74310db11e624b", 0x8c, 0x81}, {&(0x7f0000000280)="9b696ffa8f069728fc10b193ad011dc55c69e72eda588b452e83e0394a94380fcc44d3eae440b73ff499", 0x2a, 0x1ff}, {&(0x7f00000002c0)="32d82db81f49c0a9cd490d1f4c16a80b12adbe12a4a215e5780216a5ba59f495c5a0909bc9a67ad7b65c97b4567d29e3db071511202823be4f616f94598da331ca9108457cc8373e42672bd4b192ff080faa4a2635c173eb66d854868bcc3203c1ae59567e796d42c7e3037d98413ad6e6e0a9439ed33da2a83ccda303385982516ba32a1749b3fa44f67572a1a5f6be790f766790b2286dc4478cb2ba0b", 0x9e, 0x45f0}, {&(0x7f0000000380)="b426a7c8b07a904541d932ac829eeac13b44fac2869b2d614bca6ff89e74979edf724a619703ccc6173a32bbedc8490f9f32a20dff2ad54fce285a30b5e5096741344bd5", 0x44, 0x7fff}, {&(0x7f0000000400)="4180e30cb5a60bb8cf369b17c7e87c0a909dd5eeaecfdd3968f6bbf209070de6bce5148917971211b6aaa5d8d41974038a2bb6bbcbd4f87c3c2ef706875241733200401293f2921e5bfa2eb207a13d2822d1b8b66b33193984b19216cf0732d4b617eb252345967624e64c0da543b516123ce733ffe4a5a63b2eecf1af", 0x7d, 0x6}], 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="3d2d3d2c756d61736b3d303237373530312c747970653df605c4642c756d61736b3d3533353330362c576c733d6d616363726f697469616e2c00c911d79fad2e789d9da088746184884ee69642a8986becffbb256f31636e9bb735a7c93b511314d363200c2b873b684e78d515429898df3461aacdb86083214cde87cb2d283f019cebe1f567176b4c5230e1c3c4effdc0521d77c1b96e3064e38cccf15ebb63555ab927215f35168a5f002fc3b191404c7e14bc35119107ffb7ce5a1773044195f3c79e0924f88ef7aaa113bc1a25c78992bbdcc3e9c4b106fd732b13524818407fe9a0f21021235f13256d65824cd417e78c4f0c941c8f3f09c47984dce56da8e77668213cbe5817ff7fbd93753893ff317ae08beb11bb6014fb562f5f80289f7c741d14caf53deb915b0e22f477c5a2ac2a2c94ebfe675b07b51ce32aed2a59c19d7d30ce859b8c9772cc0e79430d963efc0b0064fa9847"]) 03:00:45 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) 03:00:45 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:45 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:45 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x5460, &(0x7f0000000040)={r3}) 03:00:45 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x600000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:45 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) acct(0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r1 = accept4$packet(0xffffffffffffff9c, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000080)=0x14, 0x0) accept(r1, &(0x7f00000001c0)=@alg, &(0x7f0000000000)=0x80) connect(r0, &(0x7f0000000100)=@xdp={0x2c, 0x0, r2, 0x20}, 0x80) 03:00:45 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x80fe]}, r1}, 0x14) 03:00:45 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 144.630805] binder: 11936:11937 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:45 executing program 3: r0 = socket$inet6(0xa, 0x80002, 0x3) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x201fd) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000000)=0x7, 0x4) 03:00:45 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000140)) r1 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0xde0, 0x200000) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000080)={0x10000, 0x28e, 0x5, 0x31ff, 0x4a}) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') r2 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x8001, 0x80) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000002c0)=ANY=[@ANYBLOB="09000000000000000f0000c001040000050000007f00000008000000000000000700008003000000010000000100000002000000000000e105000000010000000300000001000000f8000000000000000665c31a47ffffffff000000000028a220a9d680e78529b70000000000000000000006000040000000dceb433add8ac30007000000063b8244a2560fcc0800000007000080050000000600000002000000ff03000000000000000000000100000001000000a943000004000000000000000a000000430e000001010000080000000500000000000000000000c002000000ff0100003b0800000100000000000000"]) 03:00:45 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0xff00000000000000]}, r1}, 0x14) 03:00:45 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0xae03, &(0x7f0000000040)={r3}) [ 144.680827] autofs4:pid:11954:autofs_fill_super: called with bogus options [ 144.696957] hfsplus: unable to parse mount options 03:00:45 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xf0ffffff00000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:45 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:45 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 144.742187] autofs4:pid:11954:autofs_fill_super: called with bogus options 03:00:45 executing program 0: mkdir(&(0x7f0000000180)='./file0/file0\x00', 0xfffffffffffffffd) readlink(&(0x7f0000000580)='./file0/file0\x00', &(0x7f00000005c0)=""/133, 0x85) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x242, 0x0) recvmsg$kcm(r0, &(0x7f0000000540)={&(0x7f00000001c0)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @ipv4={[], [], @loopback}}}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000240)=""/94, 0x5e}, {&(0x7f00000002c0)=""/51, 0x33}, {&(0x7f0000000300)=""/66, 0x42}, {&(0x7f0000000380)=""/69, 0x45}, {&(0x7f0000000400)=""/133, 0x85}], 0x5, 0x0, 0x0, 0x2567}, 0x10001) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x8, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000000040)={0x0, 0x100000000, 0x20}, &(0x7f0000000080)=0xc) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000100)={r2, 0x1, 0x2, 0x101, 0xfff, 0x101}, &(0x7f0000000140)=0x14) 03:00:45 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0xfe80000000000000]}, r1}, 0x14) 03:00:45 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x8000000) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:45 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020940d, &(0x7f0000000040)={r3}) 03:00:46 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x40000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:46 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x890e, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x1}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f00000000c0)={r2, 0xe241}, &(0x7f0000000100)=0x8) r3 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r3, &(0x7f0000000140), 0x28d) 03:00:46 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:46 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0xff000000]}, r1}, 0x14) [ 144.885333] binder: 11987:11991 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:46 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0xff, 0x80000) ioctl$GIO_UNISCRNMAP(r0, 0x4b69, &(0x7f0000000240)=""/46) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000001c0), 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080)={0xffffffff}, 0x117, 0x1001}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000140)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0x55, @loopback={0x0, 0x1}, 0x7}, r1}}, 0x30) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r0, 0x40605346, &(0x7f00000002c0)={0x3, 0x3, {0x0, 0x3, 0xffffffffffff8001, 0x0, 0x800000000}}) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:46 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket(0xb, 0x4, 0x6) getsockname$unix(r2, &(0x7f0000000100)=@abs, &(0x7f0000000180)=0x6e) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@mcast1, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@loopback}}, &(0x7f00000003c0)=0xe8) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000880)={@loopback={0x0, 0x1}, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}, @loopback={0x0, 0x1}, 0xdc, 0x2fc, 0x4, 0x400, 0x7, 0xc00000, r3}) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', &(0x7f0000008ffb)='proc\x00', 0x2000000000, &(0x7f0000009000)) fchmodat(r1, &(0x7f0000000040)='./file0\x00', 0xf43f73cd84000ac9) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f00000001c0)={0x0, 0xb30, 0x3, [0x0, 0x4, 0x100000000]}, &(0x7f0000000200)=0xe) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000240)={r4, 0x1}, &(0x7f0000000280)=0x8) 03:00:46 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xf0ffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:46 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:46 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4040ae79, &(0x7f0000000040)={r3}) 03:00:46 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x80fe]}, r1}, 0x14) 03:00:46 executing program 3: r0 = socket$inet6(0xa, 0xa, 0x3) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) chdir(&(0x7f0000000000)='./file0\x00') write(r2, &(0x7f0000000140), 0x28d) 03:00:46 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:46 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) bind$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x2711, @any=0xffffffff}, 0x10) 03:00:46 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xfdd7000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:46 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000000)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)) 03:00:46 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0xff00000000000000]}, r1}, 0x14) [ 145.107643] binder: 12044:12049 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:46 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x5451, &(0x7f0000000040)={r3}) 03:00:46 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:46 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:46 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x40000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:46 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x1f, 0x400) ioctl$KVM_X86_SETUP_MCE(r0, 0x4008ae9c, &(0x7f0000000040)={0x11, 0x4, 0x2}) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:46 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x6, &(0x7f0000000280)="0001000000000000000000") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x400) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) 03:00:46 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}, r1}, 0x14) 03:00:46 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x3, 0x22000) ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000040)=0x6) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') [ 145.275071] binder: 12089:12090 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:46 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4008ae6a, &(0x7f0000000040)={r3}) 03:00:46 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:46 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:46 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0xff000000]}, r1}, 0x14) 03:00:46 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000000040)='fuse.', 0x0, &(0x7f0000009000)) 03:00:46 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xfdd70000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:46 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) 03:00:46 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:46 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') madvise(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) syz_mount_image$minix(&(0x7f0000000000)='minix\x00', &(0x7f0000000040)='./file0\x00', 0x80000001, 0x7, &(0x7f0000001600)=[{&(0x7f0000000500)="030762055b898669d0d5850bf01de25b32cd2e9717a1b056e279c36a8688fd58aa1d2569b6ff1e32055662a32d43cdaee18c897da1ce51eaab4d987f56334ad603291acccb3e9b2eca4bbc8d6a116e9fc7b41b34dd0c724fba3b18368d3903e2820ebb9363cc46ea1782319c5a09036e7816092422096c0eb412dc7ca45e23ae7dd793ec7866324ece40931b29a88f66d9eb28b6f4fdf8235a75be3cb702996773803af1d39087ae2e72796357c2a1fbe6191e95ec4deab2ece64811f9a5439f9fad615393e5c7d957a0efe1e247e199bc51781bd6f093f2ae8a7e243ff89545714369896880fb67b6addeedaf48d95d025f0593e4089d8e4637bf5fee6f514b2c503300fea98a83dfff80bac639cb6345fce6743a2002e59273f62ee270046885ea012fb8cfb106eab6a609bbd5a2e31220641a2893eb580f9019b7b439985b40fdeb583dcc1154aac88626c59d45a6d2432fe91c028d1f724455bf8f038a7f108b50b7d6b899dab7be777eba3e6540720b1586147477e11dd1a92e180ddb49c321dfde931c6594b1d97411be52202856f46d81a4de8da2969ebc745076c26ff79f3af094bc4ef8aea10af6d53b8ac943c22804247fe6ce8c287835678813523f32b95f9715b5adfd212d028f226ad15cb5ce42e12a5144334a650489c04f10dedfebdd3e4be71a1eff3bd16b66b92b2342a4dfde930489f0b4f7ed171b28442bbbdbb63ee0362f3b7e77a950ff5e9ba9028d45727a43ac8456528029193b9dec5a8c9c24c8300c3cb31df9a31eba39263a8f10395be056615ace581bbe2618ef0164aee898f0392d48882f4922fc4ff7e05bef29e281fe6ff79a9332e21948ad35488a72a36b5df5f85045dc715ebd4c3e236759860e7c547b29fd07b796105d9874cc8633a77d378075d671e6bcbcd64c9e81ade50711e14959ca450929245270c039bf400c58ee532b2785bf16892413d317fd070c0933c7d7982fd91e0dd8fe568cd06b6afe50bec5d23f6af68c694957db6804246abfda9dd161b3d0e7a8efa147a914791f85c6658eac192629fc0695e0db366e4190dc3cf3d404ce2dac5e33786f664232fc69184fafb9160f5e4a50c70328932316838f714f939efd490b56212a3a539b4c743835c80bb3f8ef6575628cb8bbde96bbd85cf238642c7c90c3f89135c2970340487ea0f51b2877f49548b685263771eda8769f9b6e28a02ae05998b46660fef0b260cdfd455f4493a983aa7488fed0eb2732b6e1dae4a74e6edb370a8df932fa84e5d3a99aa930c2b39d60718bb60d51382a0f0a42fcbac1a5dc4ebe39b1d968701e678aaffb688259dd3c4c5f7f9c4313bb2a0f3e261574caa9cf96e1c3c7aa4691d694199119ee856a00484d87cff9eddee01ab4b9ad4828ebf8ce98d54333eb5c2482dc26dc1670462536b710be413ab6056e891ec836f72a9d2a2f1de29bd2122e5ece11efd56258f75634ce5b749e7fd7c30b564117aae8ddb8d5914443861f94b964fab3174e384c7c7f86e5b178c2f5171b91d8da42b3ad73d2d9ded18d43c2ab64886f216fa28b95beb34bfb2d6099c83a47e453aad329edb562b5e897f876fe36182b2d7053d4dc60ebb75070db79089b32b9d02fce4cdb81c5b1ede4ca51711a001e365ea8361861ef530052a0a3fac289aa95709c3550abb9ff9580814c0b593adc15b1cfbecfbca9a973fca30081d35c30b10ccc81a8aa5477ed89ef2c89cc8b6538dc2430de12353ef1a84d496da477298ebb0b9da7c5850845cf5ec49cd78a064bc9d5d0ffdf7a1f9cfd30664da62e979d503086328ea563ea69bf751bf8ad319c4df431a93363e4ba3302eb4c6ca710456132c36254848d2047deeacd4f749f99f313ec0122956be215e7d364a10cea545ef74cc69b044d4a4024dc1b4117986ebb1eea1bb562b61bc4614891d810e6a299df08cdc8ba1c634add19b0d89892341aaefbbd10cbe6455ae68b14fb7f23824f9b8d2777ac5ff08538e62d018a972e33bc8707ba17808a49d702b69e9791e22ef0ddf9af642f9c7ef395bf22397e3fde27215b881ca7a80c201dba34f965bd6f4983242fba995bd4c9a146e018f0da34b74109a67a3f9f203fd1076d74d9d414132ebdd74530c2d67cf6e317d539dd2b1b7d295ed3d6406fdf690799924cab27189309b1b9e28fba65bb15480eb0f17a8c7de5b12be976a594cfb4420d21fc451d8b136cfa0e2a4c0a9705dd859595b0627b11e9247e7aff28f99f87fcbdc784ebe185d766c8573e3a69af8a7d235b9b842e03d65a4687014593653a094d8f985848193897fe892df3c016a2c8e648fa91353d9c232fbbe321a024061aaf3c1df866d14e540f6c65eea0ef0faf9772ba9c170cae5d5ed7b27a5002bfd964dae2e13059e199e90dce0c82663e0db90085ba859cacfb5f5dfc18bccf07078c28130714d6be3e053ea0821e53d26027d5104326e30fe70b0a364ed23c789ae920a98093c2cf5868246972b1ec078cab387d4a2c8fac2b4583637a76b96dc16aaa79616c29e35e6857c2bcebc34176a8fd7ae6e750b35a2dde32bbe78e7279bfbdbdfb34273929197366d21d9c3fa846fd2076fc9e48abecb67795783c7c071350a14e0a4096f2694ed9c4c5d0298d48879c54ebc1fff602c688a48710de221a738c21b6bca93945af4776618b126ba59b83ca017b7d1d52318b183f2cbdb30d477bbef38ac12a447799ceeff099a6b3a25009fa8966b9372454395342fcfa04f66a0762b310fba89efc8e96911a584720f8cdfde5bc97b4ae6f169e5a7724af52df8e884d57c95faa3a15c89467993ca7d60ec425a2a48460252b971ad3f6e277719d6b9d8f6fd790421d7bd3c60fc91cdc30884dda4fe2b2fb6b284f83986fd9285b44dbf4dcc7c476f83a99f3eb0149d19bbdf4458a067577df7620bda6331847fe0a170b4cb501a7d401c8a76254f475fe05daa279c839b237d98b10197d5a114f33d4e3786ec2336e798f11b5e43e6c1e7768146c33d92d42cb5e6376396f9f305e9c7be186bd2c43bad01f8f1395ff0a0768e893b0eb44162aa3993467ebb80edd6e768b479e3b221d1db15348beaaf6cfddae40a4439f926d77ec566d388e328fd1ef2f10765ebee8dec01f569f7a980b380e5682a9e390f4d09a68e7e07840e7367dba21e1a12f2d41235d6daae415cb2471878543cbdb3aceae17d6599f3de01379b111e94fc51ba7c96b699d1388aa19fbee468a0b93203bad2beaabfd0c8a6ae6c35db0be7ed1675d3c99f594aef8f1d65439c4dc32c841a07f141451e5727b334bc9a6f895334981e47c445c6de11afe1757ec4f79107a629083fe7508c1d4330a9e32ab6423e118bb52faa53ddfe0ff28fbd13da927e6517c5f5ea0d9475bc77dc3f69519060dd50c73b455868111f7a9c0b97913d22c4ade4dd09134324092010617bd61b26a4ce0328861b4ac25196241bf34b45f9a24c5a4ea0cb43765d0188e7e076563970534de0a8c79f38ec8f2f6981ae6cec700db92e2c03055b4725306c91f441c073c40036baa7abc6453cfecadfae15bebf431a5e968d89f8d4eb6fe1e11bbcbd37562ba266399c747ccb1d66522a20817a2cd61d3a4753bba14a38c4318a2243a93f54be279fbf247029b71cdc75dd9488b0d8f79831cfc4fba35fe73d9a4c630dadc27eb23150a141fb7abeed28faf0740645cede2c70b7189d5a79a0acb4dd68a2bac5f2ffd559b2415bc999dd4b4a77a87957a55e918d3bcc7ec71c977431ad252c531f95dcd8de6cdf23ad60c3ac3b40924bab2609d8c5eadab688d7adc798f9ed2c2cf960fd4ba5b3bb94f97edc284c93a43d79488909e8725752dad43704f09041109841d4bd103f1bcc1d3c3c70d3fa47d3bea166f704eb022dcd5b6ed57137092ecc7983d48233e4be04ae8b53ca42bbc7a87e932ef9a6e28d018ff0d3f3def4fdf37b54dcdf3fa9eb17f33b82ae39a4858f26bb776dd2735230b80c837f86cdb6bafae4a11974c6fd30d72bfa37ad5c32360316f02237d13fcf59efca6f9b7748e4f416dd73f79ca4e13737547b136c728042984c530a0fbb3ee377972a9016f768ce1065fd05fb32d2a07fb0274d7aa6cb9673c5e81c67b176f3b11e4147c29294edbef27f58bc9a491b8e49ae76716176cd800d9af74ead00955bba8304d8127947b9ba3b59afae19df53e09129d48ca906a42df588de71d7279057dd6c3e081b67588b89958621f559494ecaf68a4ea51e0e4c895f986d5c7e099d381f3fa03bcfc0d1831072936af0200cca4e401c61e082b3f4f3afcad92b534956e2c8c7127ad0295315aa2dc2fb224d2e327fc03179c85655c720103151738ec08ed27c14c8133a96d75421bf2d280a3c9db2d0bc064209d18606cb4ef14afffa6e6803edfc5843feed077f458e0922d4be21f4c2edc9023d65e8a861ae7e8d801d79961f04bf5369b96c39dbb05d947d37ca5e5b247f6a9eb13785552659af04d5650a55e0169d8d04f8ed8f0b8c71e748e0046259d95252669656e6ac293c0c2d28b2c2280f8b8849d477a8011961f041e3048320504714b4fa4c62f747f69b672cc461f2b8f589cf22abbd21af48d135119ca9a8a3150a50b22d9626f67e7b2e16101b8dec6b2bbcfcf930f8a94a2f73ba65ba1495abbc39994a41228929f9f66b498d5f3c3867a0889939a5539fed0b20421fab74b8abaa687501f9f022dd6f4308120636e89571833d5c7dc247791852812d8bbf1815a8f5217d1df2994145cc7f5a4feac43db6340b69da550532b6360072712b41fad16a090f3661fcf1c9ac257027baa841d74100ab9d211cc734a2f8bcda7c2d25dd0b9cf1e843dd1b3afe85493fc588df55be786c8120815c6117ab1d7ce038d55e34b8377ed5ec1d5e81c4f879374d59ef0b878e1e00944f68afb9055a7452959805035b1fa833f207394bc2a3865d5d1ff7dcfcd2a76f34161df86ad5c8a101f170a9af7e3ff090a3c7a67a589b226dc6eafb492460a4e4ec9f8cddab9b77526a5a0d9e9cb32c5f079633bd63ded0f55be7b32995132a53ce730450317d21b136226fc0da0d310c2b133bb96836fe4e31dc5dce4b38cb2967ade8161052c0383deedfab560afa56b8b89e50ee6d4228984c60119d2abce791622e6fdcf3efb7ed810d36cd13bbf7fb7d587b52aa7e67950f3cf42183802f6199edaf488e106f61f782521f2bf1ab99b0c7c0c00512f489febaba19f2707ace1baa9b9b39971ee6210d79b7712affb464f5a765c0df25dcdd8a463091aa9a4f5344a2b18b74b342976d260cab90b1b90ebebdb4bdde1bf1c1e0c3b8a4157bcc658460320e250e84955cf35681ac44a91073e8717345a60adf0fb52be0173970a83a0053bafd89041dc1a762607cd20daf51a4ed3713c126e2021eb7fea37e320c29640dbae395ffa85aaa718bbe917092d5070926f6f0e3e1ef816022de661db7bcd45c7d315f006f7284c4b9a3f93f77c966027b7e7d35371fd854a03a7e112e72a2e68a197bb1e28d92aac714a342daff7dac155b904076cab28a5cf0c7183d9cf3e00b5628c01a0126f45450ff7279abf3d6211391e29f44001466950a0e2ade437fe82abbf9bb6bd8bcb343c6374d65fa765f775d52f19ad7cecca3d135b4e776c2b7bbb08fe5dcc0a83d93644664d36c6d69cd4c044342fa571962c564b1cb8939e1d3ab179eb3c90785cf506a41beb435cadd8acd0d01de13e7de1d6c543de0c8aa5893eab3167e8b07fd75bb3590b337a104ec948babefa806afe57", 0x1000, 0x3}, {&(0x7f00000002c0)="cabc63a4d11b6fbe0baa78dceccfa6b08038dcca52d41d0cfc4bf68fdbadfba38f8618d815dc160b3823db432157f8eeaf849fba896f5799e9088cc5574f189dde8d742d5ac9b80ff320454dbd681b78f7563650c22a5d51ae326572b20faddc691b2b04794bfbb591bda43f6f52aee5987f52de84c6fbf8db8ad6a8fbc46a6694170c24aaa1b1ecd5dc29c8bcca0b200b30869cd08f369aad53865bd42fe561764de602857eb7ab4af5e8e303a11411f50bfbcda0e44286cf4fe24141bea8dc92f438695621648c50c762c828b9e4ce66d99d258ddcb88008d6c14dd49fdcce9c3abca76b95f4ee7927251fb93b1a7c0356174f9571025923cd90fe", 0xfc, 0x6d}, {&(0x7f0000000080)="1a89b48b868f420846969f75bce6da70df5c5cc77bd203bfe00cb1", 0x1b, 0xfffffffffffffd0a}, {&(0x7f0000000100)="8d523516f3e255033c77132ad4de89a242a67c495c06d17ff161ba31af7724bac4fda7142ac154b04cad9518d9b4eff314e2db8e981654d7f2dbe1f7dbe54768b75fb6e3447f1ceaa739231b7b79e1176d3971843726", 0x56, 0x5}, {&(0x7f00000001c0)="d0613a8bd3076d08237b5239e8880aaaf4a458cee8c354f6256ca3dc2a585fc77d0181ceda027e3595859e", 0x2b, 0x1}, {&(0x7f0000001500)="1cceceb8210456769ef7ac0e3de52a527df6eaa17fa3d0e1fbbce9796a9c8bb52c337547ff273c908d01905bb05910f5e37dad21f53a9752a3cb53692357603101d4759d8ce5b7d58501b4e45a184a399d8a1ac6c55cbfbf8589ac6fc08c20e0e2d2abfb9be4b4d92735d2170158b851ce1fedef023dba8aa3689aab8d3e38d0b81bd03141a1986b94ae6ddffbda53b5e4569cb1afc46d559ac7ab1fb5b11a767bd72f4869a8278b1113f07fb08798bf9a6bf1ceab3448978db4bd2eb615e7e1925f463a", 0xc4, 0x8001}, {&(0x7f0000000200)="ff3187b105f3b15bc97d26d648755a00ea826a4b4318995ebd20c059dfad15e3d362049879133681bd129d64f9137b1a8a25ceafb3344db48de372eeba918233dd26e0e081c10d3e0bd0e9eff6f1d5", 0x4f, 0x6}], 0x0, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = perf_event_open(&(0x7f0000001700)={0x5, 0x70, 0x1, 0x4, 0x100, 0x0, 0x0, 0x18000000000, 0x80412, 0x0, 0x0, 0x80000001, 0x10001, 0x7, 0x1, 0xffffffffffffff94, 0x81, 0x1, 0x100, 0xffff, 0x1, 0x9, 0x7fff, 0x2, 0x34, 0x3, 0x83, 0x8, 0x0, 0x7, 0x20000000000, 0xffffffff, 0x7fffffff, 0x7cf1a315, 0xd5f3, 0x4, 0x2090, 0x6, 0x0, 0x8, 0x0, @perf_bp={&(0x7f00000003c0)}, 0x10618, 0x1f, 0x101, 0x7, 0x2, 0x6, 0x1}, 0x0, 0xd, 0xffffffffffffff9c, 0xb) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f0000001780)={0x3, 0x70, 0x3, 0x4, 0x7, 0x6, 0x0, 0x2, 0x2804, 0xa, 0x0, 0x6, 0x3, 0xb6b, 0x20, 0x2, 0x8, 0x0, 0x9, 0x7, 0x2, 0x1273, 0xaba0, 0x91e, 0x9, 0x7, 0x3f, 0x1f, 0xc1, 0x8, 0x0, 0x1ff, 0x0, 0x770, 0xa00000000000, 0x8f86, 0x69, 0x1, 0x0, 0x5, 0x5, @perf_bp={&(0x7f0000000400), 0x6}, 0x380, 0x1, 0x9, 0x6, 0x81, 0x5, 0x5}) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:46 executing program 0: mkdir(&(0x7f0000000140)='./file0\x00', 0x4) r0 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) inotify_add_watch(r0, &(0x7f0000000000)='./file0/file0\x00', 0x100) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:46 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0xfe800000]}, r1}, 0x14) [ 145.450217] binder: 12122:12126 got transaction with invalid offset (0, min 0 max 0) or object. 03:00:46 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) fcntl$setsig(r1, 0xa, 0x24) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f00000000c0)=0xc) r3 = getpid() getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@mcast1, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@dev}}, &(0x7f0000000240)=0xe8) sendmsg$nl_generic(r1, &(0x7f0000002900)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f00000028c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="c82500001e0000012bbd7000fedbdf251e000000c4126900dcb3e04e980ac500c27ef3962aa33f7ac02c179b00c7bca78ab4fb6519fb06135556d007ec25ff0fce10fda3058194ba414a9aaa62fbfd794f07cd1e74ab57f840dc539d7d8e7ed458dc6019bb5d9fb4cd51cc64fa00257fec462810543261c16e3e38f34f9ce49001b9f8d8fb83bd46625252d4ba6ba8b289487fc3f02a489b8d2f7667ad8f8017acc5c731ae1ee72d18f47689bee92903bf6940c9988ab208c13ad692318d586d57d7e6668071448b6bf13b62c229988c5c3b2c864a7b4f20eaadae350f061193d68d34d3f225e4e4c4f93a4086f0316ca5a5cf7f311572357452592fa72c251ebde7ccf534324296283e1d690983fbf7113e28891611e0bdfc39ac93c07100cee8f091e8a697c9de4e46938ebe292e46900bdd1d1e9018902884cd96adcb45d659091fc7add5bb4d585c6556279c0bf29948b0d4f13c1524109fbe048b58e4fd42a4fd7915c0193302944a727dec05a143abde44f93ab3959075e5e3919cfc4e85b7b9d705b0786b727183b6d2c66cb2fea9217867a973aa46153dfaad5a7b07086d26a8557e85f1acef627152aefa60f42f44b94d00ea87678a1a9ec41ac245767a5af1a8e8b8e345d6a6007ead75b14005b03a105a46e4e7877103634818920a47a677b0e1122d6090006a3f5de088493d50da4e8fd1d0e5cdc795897e13abb83a580ab6ff75a3b02a7973f704b2db52de53d4fb2240f34baeeef1580e52e606f9eaf1b36065359d70202bf5c3ef42d4d88fb929025889cf7d40531d91d44d1d8bf40477b4da1d3d63058a3b62fbbd3b0ae3eeeb9fb77c87a4b18ff88121a1ff866f0348fb761c597dab00e8993f77b9132f9f55c8a168cb0d594a35fce09ccce7eb580425524e9657328c6e4598626780becc2d5b817f5798709385e3c310b7803ddcb9b1431d0c4113b74ab527997cb4c41fe931d2226e3a6d36ca2f0f131b51cff8869fcd4e8168b0998a0a42d29aa9dc1b5fe620ab32e1bb360237a54eadc3c3f79d62ac1b9f522f238cabc8dc82358f4204df587adbef1118160524123667257ef242065a8fcff7cb55f3bfdc4443ed60cbf0524a8986bcaa0150710ab33945d4453faeabe48710b01af09bae21337f346c028050e34ca52f310656c6cf08ab81df0ee71c820abec6444efd79f3ed0b261ae9ea4f709692acb76180b8a5070018202d36e0baa40eba12f47832e0280f851428b8735506106c72e86827684afbd6371ea6efaf5f9b1774634270a7aa0409e81db67ad363eee058b41bf16b87486ba2e8a9d9dcbdee983091d55d5968542f18cfd553bdcb469f0f2fb36a3e792dd9df0264d4b6b8adeb23d0d153bff996c9323a345dc4664b41368758c8895381e1ccd751921db6978efc6ee9a4f7cf3c2aa0100df231dc4ddd7e07b3d149a9dde4c189d004693d6163c6116518427a21737fddca6de5aa6dbbe5173836579e34954984d497212f873a587602b2106374552e8c249532568a74f93383a5f5c8aa2f167f30e1e0e3b6e58c128f9f0420e2f911b1dfcdea4aa0474557fab6b34cf7c1268f8d9a79e90a8ab16a3dd396f9dbfb3a6021828ea99667c964da7e2ccb19c2e57a5e56e375310630622b3cfff70425d990a8766defb2b8a948b15ffc9caf7cbec33bf4ded8ee2942537157fc4f75330a5a65307d8d4de6195132d5e3c86b9d2a8eeb2fd068cb2e384ea66c7d6e1982a2806b30e10f03e2e7036c9d3aab519bef8489cbb5f6f3ba86cfe9c0484820ae3d4d57a92a8e4a1d71c07ea02435abf5dbe32e193445949792a5a12f850dc8c71693ac3e3fd7742c93d625816a1173a7124c2b4bd69544f8c628e9d2df34ba947b69300779dc668971fec5af76d35a11b8dba7c3e7627a171fc10f06da840aaf0ff2fbcdebb125c507299ed53c170b6e9de115f53a05343ef9a0acc3b278da172136940bdb2274f10cdccd213be80c06099e59b1576413fbb2ab0086c566cb41a388a5630d8728fa45aa79e433c0ad2a802cb6f607a7c1a44d07c2c966a813ab8b7085a68bc30c175ffc679660413a20d58c485fda918413fdf34d80c6e3014135e1d53e17a0760fb7794451a149701a8f7c2778452a7413483fb53ab9a5ff5c2ea3d64c6ea2c0554790b3c297e626346619267aae471ed7087964c4c4b137ebe57ae4a4c6450fdfa9b2e7a8c97b6863f7ecc398fc6429e47a01daa5e247a9efb121d67b7f1ef073266016876ccdfc4dbe116b63f75ba2bc7eb2fefa22c5cdd9a0343ff81ed29358afb869cc39df7363493355c1de51ca6740289c1db20685f1190b9cfa0d733b8cdc2e35f6478610fb47a871ec82ddd584548031fcae5f7d3f5c941252e4da0908c45cdb1606f647ab24596e32769c272c1b27a48b95138e97752074fc4e015d75f045c8e859f3428d9595fb3610c996a3103bf8a1f781c3c8c96bf311c4b510b0de17b632fa2439e4b767e705a042dd7506bc9e1de14abfde0a4135d1c0f68a70aff7bb73fef49add341dcd19a0e0fabda4bdc3be1cfc17a4c2b4ff3fcbe01d029f74178f52b0e00854b1a91cf36db28c4dc2358a2934ab4973fbceab9b6902638fcc9cc92a6b125fe6a5dc5d4a69df38bb460f53d4c47627db082edd2475fbc7f22aa7dade50df021e34ccd29dc0021866787f805fe51eb23bbe5fe99703d23478b3d0ae6ade525b875e036223f7451ac097c2b15f788e89d7ad32e3ea478d4b58af92ead7552265a1d6ac3214f3e1e48dcf0ceb850002189d1f265ae39b612e55bafde1a3a1822b788a16af01823f57159d087a61330b63c32aa1d65985baa37fde5c338a0387cd67221d4a76d7b0c25cde9d7c98c565dd6d5ccaf48dc83d222080a0d2de8e74400ac0383d78829bd77872c0221b12a0254ebac358dcacf759ba0b5324ff571cec310a14dad14ff41af5ecf4dd7254f116ea2aefc0bd697d69059214d7d39a4f3ac69a7313d5107c4ba34407556f29c74002bcf14aff0abe27c96f09a73afbf8dd400182dc24434d044157ee6c8b163cc47d02d99318ad9fabcb4e2149fbc848169efe565c4ec1e84c355359b3f514ce037d5dd98381136a6b7bd61e2f7e5cc54c9b4211293e8d040cfd56aab4afa52ec29ae1cecb05a74c909cf79b45caf8634c4cf3e105abad02a257f2d8afe729929b36158523223c0f1c864a935001722e520c341624b42e090f24b1da0b920842e4627a75012580e0751f38f4a372e0718a36dc8e4091b4f5594ac40c35e56c26e9617ebc873ed6f78c1c405b1a155d9f36bb49f0d32273500794b2ad4ba6c21fe658241cd890e100d231ac1fee01ac39a87dd1308f039bde8326a4aff5219378597cfc6b340a60812c425fb7054a0907fc5dcfd6912af9c863e48d2d26a452a0ba9140414ebd4245ec7858e6411c6c1f9075261fcc01cb3aed6e00d84a7ea611bb116caaf2c550257819d21d831e0773b4a959bb23ec604c26b28b2af3f3f483a054c91f359f3954f636a53089048ea74df766b36c8b07c0b3091c77fb2ae9aa9f0aabdc79097de27b5528a0438e398419f93a77a81a6857d0b449fbf3c88ffc05ff3f17016c417a62beb69bb160b56ee4ba0eac8af506646e442c2379a375f90fa95d3672dbf2e24b1348a5afd667989e74772dbd0a7e2e0c2a25bbbc4d20c162605d1f4a58dc16cfe5f1e5384f2e908608756f93b041a45cb0cf28b8b46689a70547c6bd5840befe04c6778e8496d48219b539e4b6a537f99f0381d217eb2f55b62128b23e2153826f38b22c7dc13ed1c5a51b129eb15c3bd96c3558960e8209bb64e7dd357e35408082d7abe4cde1d85685807f02429bc8bc20288cade64875719aa3ba2eab871595bb3365eeecd2c3a2d7a64478ec3e954d2511bc9f4053244fd0facc192bb38b012a6573c373ff489e61082a3bf1ca18ceaedb96575c3d0277d3bdf9bc85d4d3a7d2787a4f8edb97481169558f704e77b8696a4a568f7808c589d9b23242970165df71ee7207c145028b63e120de943a3decf78dd86903cfb4f99b4ffa199bb457be76bc2f7b72ce977781d47962eb3b80bffc78419212f2017e77951391b6c494a5729b9825f0bf84948857714d9908c310fb5dfbaa7f3501d63c78baad31543afa1d9730b721ea9ea7f44a258e29e7341d8358ef9da796f6e27eabf49e838ee7f85b3604cfb700dbebf4eb7814025be43078f93f5d265ed4c2b98adf836ede2874267396b4e2a645472cceb4f60e6ca3c2e1d7b78fa76304e3256386bed9b6ee34672e28bed1c84b6f9cfb975418218bd974e31ad52f11b54854cd7b606ae3ebeb32fa9ecb11e65b32f6aa5a08ab865ed1c66c6fd32f30616846088fe467851ce8f26fd9fedc6f6f79f664baf2f5a01edddb9cd71ca6ccf1df056c5f0359ea63de2f86c65d83fd092ca2b6b851e94ffd53b13f4c2b81720daf79ee15f3c4aaf11c715d2daf76cd00ae086c9c7800faf0b81f161091349a1dba07644a5499ad5068c0d2c49349f4ad2e9446f6e8ba5b79f5b76ab8f21a8248bef24d263c5d0fd81a55d3867f23b00c65752fec98fb345e10b00f9d8d77bd48a1a84c2b361306215cbefd8f13df40140ea66f30177d0ee1a9473e5ec50a99c76dfa6af007787da455ef5f98f6616d091ff6c315e3f9b223238cfd3cabc88d2d334cd279cd9499a3638559b1fbad869636c7570f172927041378e0e0e7408281ffed2555e21e41429137b5584196d10807adbff5ce79b5aa2ea492b02c232c4069460f8f6d7df6cb83509e0fd765452ef90a405e291c28993e7587e2045ffbd0c7255e3b8c24902276cd01cd28c2ca837605085f636b7d135c67c8eca6b73c57da603aaf337a66da61a6911ed1d73726819c2742df8ed69a48f5993cc862fded487e8e60929d1219efb2e6e62bc1b1f9ca926bb01278decfd59297659971252e83fb89c1a25d90dad0ab49348e4dfb51d0f9199ac53fd6171db9b9a70f48e1175186611d626bb708fe4178f580b0a840bcb720f81aefad9b28addefc408d574f88caea629972e1aa7e5991ccf4aba378211ec5e67c2879c91c5dc4b6d85a824850c0a7db7ef5519b2a870e95c28d85c9adcea21b644ec1042469ef44ffa59ab52e6a337ecf8468e9115ccd5082f56e9bdd64de64a88f09cf40676a743fe91b8d82c686a0c80d0714cb381352f3ebbb2dc7728066e7138362e8e23cd4fc592332ca7f95ecc6e8886605cc40c6c91627b64d3f1b2ca4d49843b5fd7daec59ec9172bedfc2b9cc9f2b5cacebcf7bfc56c2a8fff37e04ae29a65cb2efe12679ece6172b8a85f75bc69fb4032c046dc6672d337f09702c19d4d48fae7bbdb69286bb55834436e3373903fd8ef7d4cf103f60fac987d4ad7bee5acc069fa6b0f02f866320ade5c5629c8c7f0fb345e20f099bdc5b8b6825dcdd0f15b8df71f44b1f345206e4afbf98349d58719ecd796186f90eebff1bf588cd7fbe368e5d39f5b55f3c318beaa94e2f317f38302e5a56cafbaabf27f177781a88b760e9978190f22a2e7afdeabf841336d5499186622c5805155d9d69dc9ef121b8dab18fa93756dbb1becc762852955159a9d3a7e6bce612ae08a7563667c93b60b987d6de9f65690fc5ccf89aa9aa01c94540d55140accc2226c4c2647c562302a51b1c156bb96344fed3ac305da041033cdfc27d4322245667b170bcbf2cfc662091f66fe18bd4c34719fcb7c2777afee8c058db2a14fec52807723fd0a0ed935712c46afeff03f8e3af80fe7e9d8d45fa74f252cc1fcc2f99ebaf0d534f99d5a8760cdd0451f1db84f7a59e0eda8a19ca5c2856c3f03c43e3a08103bd09a668e41c1fb207730c01750dd532b0f95d63c5b5d6684479c12aae310d899427d1bc5d27f4272fcbc37849554188a592c26e507db8d24bc8744c1ad965bd3710a4fca1950f0c1a40dd012fdb454931b8b3ca29b40db88193f1a89bd072cb0462d797e89e23a2306838f95140844e8ce65a512d8e9ff62589134f5dac17718b36ae084fec84d3e30974e89334ed92e693da4a5ad12e95da6cf5422d6883dedf380f864ecc4fb67def45358d593a2cfe97c25cf0a8b4f9e439f156b2dad6c3aca2b7cb97bda4eac13ecefbfd8a8f268ec0b1c19803ec51b42f1824fa3035eb9b7c3fa226f7ba1fd30ac3f303acf1bce3c334218560d4f513cf62e35a28858802caed8f55bf882a83b84cc0f72560c8db3fe1687dc58949ab51110bc554036c66d697daece1c8940660261096e16f930a0330cb981f03b18b1e65a4a88b4dc261f3e1801a8b20ca990de1d469268b6f0e7093035fc9003bc0ce06b166ea5876fe037dd0c033348679c0ea35e20fc816f87a7d2c02f81152b80c5905adcb3ac51020f85fb79e4d486b9b94b20bf7a9d64eb12be81ec285f46d70c00540004000000000000002b9ed78b2eee0dc6e12344763a5fce5a8809636d1010b8dfd3b5cc675bd949de3f32ff81bbc14fd4f83edbe72674f3d84f1fe92a59b3bfa7a250696e7989201df6938270ff858ee9e54088c8227c059243ee82cc55f18f4dc8ad1ace636ede242e8ee533cdfdc447dc70a5a54592a544e482523da2ef56161751a4829ee9e51bfd8f5cf32e6640a86dd779159bfcfe64f677c601e5522972d16b94f99f8ffbe72d7662935f42dc40e3ba1de4607983d4d32ab2115e39f04c4c6d57e71b764152ca03eef327d4f0b7e7432101de8bbf23f37cc3e184630a44c5d62eb5d9f2b63fe38f3976be97c9bc267a2f592ac49bebd8ca8d268f208e940c0054000500000000000000001401440008001000", @ANYRES32=r2, @ANYBLOB="1072117107aba728d2f1fc4920b7fd4a08007f6c47c784f43ca842b27e8927cefe60d290fff739c39b60a95be486f312f705864ed205845271a21c7a529b3513d8fff225fb1b9d66f1bae4cf9b8b90695911af87789f9295046b4d364c6f5e59bc7094dc32949604ee8de879b6471fed50d5bb496a072654cba837c122a78b27d531843faea2106b549ed5c28cf6a1b06fecdae061ddb128e61649e1e72268f7d8cc818991705870d6a20c4028aa2362e8fad51c241cf7ee3ee5fb80dd881510237a6a1c09af788ec0407cc9d00a0e7671080084000200000004001a0008000a00", @ANYRES32=r3, @ANYBLOB="08008800", @ANYRES32=r1, @ANYBLOB="08001500", @ANYRES32=r0, @ANYBLOB="08001900", @ANYRES32=r4, @ANYBLOB="0000009ce78c473370b4e21fbee7a993493fe321cc2a26dec0a945cbb7d2a7f1637676afcffa17ce1d4752b92e0aee6260c60a7c5be2b5ee95a7ea0c1600aa26df0d6553b18c9871fee8ff4431052ed9c04ef6332aa35a5e7abd029109ecd34b70e4dcf10bf905f9601225e2700d4568323b3456b4d05d339f80a17efc2d9a8669c151ddf3c911e5849ebeb07e10e4ba3e4620614df04ce325024917b0b66615d627a40c0aa8e17e9d0eba6b002337e6b46b87fa452a2e54da10d14612698cef8e050a875aca2a826523698f1346acc02bcc3546a18d1f62b27a73ef183ecafd3ad8368e3780700258102600d908e164e288c53b4d95424bdaa6bdd170b81b7369215674b0f75799004ebd5f316494de1df433085963ecc8bd2abe8c57431a17bab8dd29da53988b4967ac191acecc685052389a51b6e75402b2bf0d60a54bdea6ffa15fa2a8c5fc0d711e6410e004ca80d8335e13c09850a4f6f3938d9501832ee7eee8d7d596d5da95918aca6c3691f786d03203c9fac7409fa3eb1dcc91f83c1112d8602e1c6eafdfc56d7f590572ee936cc87bece19312572fcdb500de6900f14e72d90da0fefcd6904956848e09625841c2af2d8865db74d5268c0b0503f6e790f350af5885ddd609e45c9adad6fa0c9c546e56e48eb52f1bbeb13b59a0b958ea981c52134afbb1f8538a1f7b92d7f63e92e271bdfd7da8ddaaaa167adf8a576c2ee9346fecc6d1974c8d6effc0b3d319978187a9d53cf9d40264d42cd906814c3270c70202b629380ca870d9b0e914c6d2c56dd6a5ca22b4232e9d6b1139f3c0ddb22043a16b27b8497769bfc67e3b4807cb3f8f514440e2d346309eec7413217242348cc37683b69dd8594cd42b1f4b655f87a590eca8b2d8dd839a40805ae6963c8024dc7c2f344ad529e392a263f0203eb4e0a90620ddad6cc38a0ba0c854babfaf1684ee70d2eccf460aca3c4c62324eca199a03f637a36e38f59c3afed3862ae269bcbb8f4433592b8ca681f3152a7aba70aa63d19f1bc9e0399887781c800ead9d05ef021f68a2d63ea2b76a0f51aef379b8570659dad1272e36fed71a767897dd44f8c3d30bfe85274b269dc0f81e77397973219cc2cef292694fc719c558ad53de1bdd86f364164fa0c81fbf162fab9f3990eda9a90eac879072b2262d814c7a277ed2031905b763a65ecf360bb759de141124422bb398bf34777692e1071afcef83a8d4c0f03b64a645d8ffe9306df3191ab99ece57913675ae7eb7d7aec634beabbb751a2830bb349136423b98ef3f323cba4698f020088a9144c292c903b1ed1a2585ed8e718e0ae3d426677b58ffbb7be1035f81d1ca38b22b353908e59ff32f94800210a5caed230a30d74f25a9aa5c5f7b62ffeb24c8b894cb765996282089283e1f75cf53282cf341986cf040af5c1ed0d568803f3e9306dde85f4ef1768ee850b05e6030908f3f9acaa301fcb8b8cdea5f1703891d33b69111a776fd17507d05f85da9c98c75eb1b871c3d3b090e379c372fbdb709f9b3b7db6943f59aea894033c88a3f5f87b145089f3e49f7cf5b7cae307f96eefdcafe1f402745a4e6a970cf9ab2587307910e1469b1ef38e957ab39951d146a28920a70b0336fa94253c6473e3142208a75517d44846cfee05fdea4b89341f5285213f55cdb90ab59f404bd02b0e786c5d94b8ed25955f52dfcf8cc1e2c5e031e0446689c071b763e327fdcb9cea5f658fd9094c0ad758c9ce26d5d85aae64a4809a06d58740125d991aa508ce37dc72ca8b5092a3a3f2e4066d6abe3ffdaf4f081ae004783752e1f2e0ba01b724b7c8bf5392cb378e9f46cc68cbfe854fd6a8f62c5c4ac0dbdb848fd00448aa4aa0b1049e10bcb182160e8f099ced996425005926c2a35b9432b0b2ea03f0e6d606e74080465cfe3fb4da14463125bf7c03e36a227bd9f7c8342bba2677a3457cbbc8bbec31c967aa0b8c5826b3fc22c1ba83a205667c1bd900b166f4a0f4fe5bddd89e8a93a1b4f6cff96ecfcd5f4c6c2b4d2b0a2d2c9bfacead0e479e45b1b39a0c55e5dcb4e3af0a2cf9c20b755c2e45ffd58bb52a8cf48d89e02bde80782d3a3dc1eed77d590203630dd00d76eef43537410d43f5bf46c204711fc968e41de78808a45385d97a73de01f299a71946d0f0bef3b7e0ddb285a53c654641d720abdc817e92958463ef010238e8c71e6abfda7c02f4111526c1989edc89c64b3412074c03a15ea55b71a17c360002fae6c629fdcbf3ba1f438aa88270f0e9d2cbe6f44462ad91a75699f49dc0308bf4eacf37551f163b4c0598a35f1f4c2738c874f7dd16ccbbf9c343c0fa5017f7ebd75ff731cd06b939392f136cb7ac9e98cb8919455a873a5fdc69e43b3a779cd06efb69141c4127d11ea5688d720c55f3425496618b9421113b77b464d93a964f20a376ac37d9ef293dfd64b406cba69ae35ebf00b6d24049808312f493b53061cedfc35e68e9daa453a6289f6243e09b010cdc9c68d19c4c7f24d8026b5b429cf3707ca9480a113ee430132e4dd2c4b591a32e9567d0dd762d155564c9273917b7529c10f7f863173bc7d229000475a16dc04fb3755f0ef87df08fbf64b4e464bfd892a152e928aeb7b91abc114ece3ad75990b54e6ea75e12379115fd2f20e7720aef0f346715c90a388ce557c1e7b0bca38e9ae7da4dc9eb5c650c1b0dc1670f717b2439618d87c547c3a10e98c2329c8854854279c84b4f37ae1cf99535f2bddbe230080dd2de828d2cce3f2b6e72d7563bf95a793f5785e8b9bece97bbc20725ceb8ed559be9455721eaec8c7012faf95f62edf1419934ca559b7802ee785576f0c47722fe194a41fa179598b38c3f977e4df20aaed1644d04f86cb1805cb65e37e6b9857d970b2c331fa0a11d0636ffc65285fcedc0390139d539c32ee2fb8178ba5a925dc203a6f58143599f5651f5247af87551651a9ec5a22676e379e6a5114d077b0e55ba8271af78cd98f25c37e146f4d8b2a31295cb1d45c858050bd808846d3f4c69d3b773f65c4f0641835e9c5da1d9fb89a80b3ac5de1ed05270971f819f08ff748b73eb4195d158f58916cd8ed58806e90976c409a10193b908b6862078fc990bc5e7ca1f0dd37801d9b21044ed99a52968872aed0ecb2049321eab5b0f95c534f03947d8faf5c08446fef2d585995f6f3d16518202e4685762e22b2c79973a8ab848371d38069baa016ebc5b4ba172ca733e7d249f32691287a8ab8a9f19ebcd76dcda76f4b2a4c2a15cbfb38adaa6a90ecf910c4a36e04db9bdac0e3c75162bcdadc53090e06e1231ba823f8c9adbee5526ab893673bb5e3625538d64d319a50b433e37e61701f476c3317a2ea3b78d7a8284dd0acb6a9c62c8d12951061796e325c418e00a8de9b83a6d70554aa5797f392c3d1d8566bda42f7f845604e137518a344ada43c04e12b04a94e09df16d751b235ff67a3618de2bc810680e26be921422e5486f4c6b02996bd49f204aab3366fdb74e2ebafa0cc8c154bc0362bf61f56c72aef68bdcfcb0b993255d5fa081554552e6cc6cdff5c2232c37032124a700b7501ac526f4efc7677da631d279b2565520b27df95975e3aec4591e800557affcbc5ffda54078b3920603ce7171b6308ba91eb074bbe870159d1916c3fc0020aa8d88ca59eb3709208a0f8e0e5af613393d438f58b389227f09627ab426204f3e3121ea0feaf5a463459813a48df2103b9ae97663c842beb9fb0fac3ab2b9bda2258e27d1a18c392b67164ec640a81cfafddc1efd797b30f4b812b31ca92074ba6f86bcebb8a2c89a67f9b77a0bc6272c6ab1bdcda6e3240d520ffee3bbefe6baac2d9f7c8240bf72bce92aa149546d3168bda06458431b2dd903db8a2e52a75d5a0644704e58a926633eb79d0abaacbb4a918f48fc741c42489c24d1eb247ca6db244fc1e5f6b340f8b44dfc2a9b7b0a5861ae7e3fbb65e7e06a3f3da8618c7553042a7fd31b96389c5e0e47e88c828cfb877046d75f240ea1abc90361aafe09869eef34cbaaeb459b366875f10251a2ad61f121bccd62359a213a08c6932d307143ef296a22458dbabae5453754ad63dd638b0c8783a13f025f73d12b6adc97304d9e391514f26234d5a64539725ab9fc6c6e658b5f383767dc3c6a83fe6d5d9bde4a212f23fd608152fea161dfcc0de0e3321b21edf6460f4b135c854f045f1271c3a2447a14ae3bf5b78c6e3e74c3c577982bdf5b21e8c3c2f0c1846f187611733b9a1c92a09b8323b95509577ed47aef6cf2146dc82d7c782feeee84eee7858e51cd5bbccea132e68d8246f657ccad555a589011bec3a8f6eafc9e4ebe5052b7ae1980d9274a8710b4ea611f6f43b381cf248cabdcfaf49fb0bdb9ddf9053be2035d339818b733fefb6984c6e040f042fbbf3a8dde078cae578d2cf1b9a1cd7298f6017434dfdbcc03b3cb2ce84de2ff4d38af4dc109d6d93aeaacd75169c3cb18db754b25b732c0d0e5975bf675a5f0c24a21853a9f7b4b9992456a2cd842c6c649ac948fc236e5ea8750a727aa911b26fdba519306c30c0714c1a11dfd2fdaf32d00c6414bee12ffa14e958a9f3888e59bf4f3241fadd8207a462be0aa41fd5939b81876890f02894169a16a06422060a5054d9768ae363062757e11ee6b27cb25a4ed08302723e22bb505b159a9435c08a08fca10b121da39622db0f3fa3cc1eca95f846bbcc3a82450fb70271df32c065cabf6f05e629ae33d186cb949f7f21d7d25c24039ac3ccb68569933a6bb3b0fd14fea614368d0d69e016dcb753004e1b5edced6bbcaaa8218a80c02036bf0c8a1776c254a1af9bc1547924b521d7f104445865d67d52113672f644ce13401f02a9959c752fbc4329095657d1485258df50ccad5c5d3c19a94970cca4a33e873171eda19e370eea12a7dd7a8ee704481100fdf5db1b8414e697f14eb60bad77aa0b20553ab51f41b0c1b2ccaecd6c1fab0e75568e5542d69fc90d5ed16b062e498f04fde654b6d1d3fd6ff05d49c519fd902be18cb9cd7a232317c02d19d32ed03ab33078b3a80777ab964c3cb6cf59082c52e061678ae3877d6f1767b8268a147cb38582ebd953c936961919a498d38a90d377a2407b7943abbfce798b6fa167b45534eb8598b1b50573e1ec1f87886bc9ff11d47c0eb17dce5de0b10df98a50364b177dda6c738d0c6f85ec9b1857191d8b1e3360ef56acb848b55cd1131fbcc21407afd2882daf16034903ee491458833509dc65e6558f970e655c01044501bd31457741d50fe8c5e48ca4cd329f9e75bfeb5d5f724a9ce02cbca983bb8f3dee109a626ec92fe15bad8d8a679865cc5d66938147c478b670290d2bbbf10e37feb86c0b48ef672c4197928a3dd0a0f8918b286c44fc2cdc4678180110b8a1bf16c098114d2b1a953402e9bddc4ba43b354e7112a7adbdf0d0558ad4cb108ea83b6d4dbde36f2e45458814373c4bc20b9be54375ab80efeddfd7fb3c20aee82863075e5b0646a2d024caa581f63dcaef383857a72aa85302111a0e7621e01291686a0b24f120a5d458de9c847d2cc320497d07e4b75cb182450ee0641e5c7d22d88d90045c0e23283383dd54dcf2ebf218e617a1739f3fb218a93db5b69f46285729493f69724f36a673c5b95c4f1fa4ddaa9c0221eaf799688505c363d9bdb61437148c0dfa339f1604e2dd8075c0d39654e618b47f00a2d8a07ca1cb869a0f61f9dbc33e8aed820dc7fa567e14d15e04ab14ca476199b19d0e3b35c8c40212e5322a5f7a2e0fd4bac006000659caa1bc0c9bb3966111b28782b9f46b53f6af5b8a882631e85e7fa39c035740eabb9d1d91fca300ba0ef853a3597f3d6b95511099cb972c7d54ed5cd03444023aac795344931828806ac5e8e5f7bf54250e05a369b00b4f321fff985d57c4457ae83fe448cb72aed5a72343704554aa07403fd3ce00f3bd0a25e8195e2885fcf2e60ef54f2fd180d652cfe701fd68c47d5aa0484cd29c3a24544426fa955d3d3f0b0f2868fec64d1bef1e938624d2b2e7a056f0f427776f95770309ee72a0dcbbf2da42336a747c63a6ebe8cb61b3f0a03182e79d03b9a0e12e16a522a46bebdfdf1e446bd640aa941a85907223fb5bc4158e8f4a2356a0564a5e9529b20868676277d1d08f89d1c5cbef01766a8abb9597b9b2576e097dc5436d5f140d218dd1205315ef0ccfebaa9fcea8b1c7bf494f22b9000000449267e64f8fe52e9650dd6326dd38050f94595a9a6575d145fda3f9c339ec55e04343169fc8d2a2d30bf9604353147b57b90c22ef54223222d4d42223ac3206afe1dd1bedab57a782a06d12dc251744ac73adf805bf159a4934e51a491554aa351822a7779a8d82f4a68e6d93d8a0f3fd458d27665f3470b63d50d1737a338cefe6f3ef48fc2f0aa2fe7507e9d3f7d8dfd32118bc12ea5290fc5add000000"], 0x25c8}, 0x1, 0x0, 0x0, 0x4008800}, 0x1) r5 = syz_open_pts(r1, 0x40800) ioctl$TCSETS(r5, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r5, &(0x7f0000000140), 0x28d) getpid() [ 145.495902] binder: 12122:12126 transaction failed 29201/-22, size 0-8 line 3030 03:00:46 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xfed7000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:46 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0xff00]}, r1}, 0x14) [ 145.542646] binder: undelivered TRANSACTION_ERROR: 29201 [ 145.548471] binder: 12122:12126 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:46 executing program 6: r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x3, 0x400) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000040)={0x4000000080000000, 0x4, 0x30e0}) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:46 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:46 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x5421, &(0x7f0000000040)={r3}) 03:00:46 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:46 executing program 0: getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f00000025c0), &(0x7f0000002600)=0xc) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100)={0x1, 0x3, 0x2000}, 0x4) mkdir(&(0x7f0000000200)='./file0\x00', 0x101) r0 = syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x1007, 0x3fffc) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000040)=0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x7) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000000)={0x0, 0x6}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000180)=ANY=[@ANYRES32=r2, @ANYBLOB="020098f057fc4ba142549258d4064d6807000700000002008000f9ff200c0100"], 0x16) ioctl$TIOCSPGRP(r0, 0x5410, &(0x7f00000000c0)=r1) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:46 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0xfe80]}, r1}, 0x14) 03:00:46 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x900000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:46 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/cuse\x00', 0x8002, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_open_dev$audion(&(0x7f0000000180)='/dev/audio#\x00', 0x28, 0x28000) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r2, 0x111, 0x3, 0x0, 0x4) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x0, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f00005befdc)={0xffffffffffffffff, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x100000000000}) ioctl$TIOCPKT(r4, 0x5420, &(0x7f00000000c0)) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000000040)={0x4, 0x9, 0x7f, 0x7}, 0x10) msgget(0x1, 0x250) ioctl$sock_bt_bnep_BNEPCONNADD(r5, 0x400442c8, &(0x7f00000002c0)={r5, 0x3, 0x3, "268fb5bb45a53bc58e1633b84183b5a93fb5dbb8d4eb95e9f909311b3b6f4f82e368d31a96a4b89dd57073db6d2ee4ba007cdb963c9c7a9bad24ba415540159a1541309f4754f85ba3185e461d28dd68ebd159e760a3bcdab89bf9a1563bc9d1d40160ab195ad9012af14dad5596448b30fe50cb11521004b8940c3db146a1b7874625ec23315ddf745dbc1eb99d6309e8a93d7189c0f53af08aaead10d3845fbdc9c118e9906a4609932e8cc6f6316c3681f70d3dde1cb085c255b12fa354df4755beabdaac2657dfe634785317c3c12f4ac6ca51ed676e50406554bf9a28c2515c9c5c7b0143ca8462ffcaa73957407da3985ae389b017cc21b161ff6657d07af7e72578e064505254e1e3f5d9ce8a534a3be7c2f58719e07bc18b5fc42422bc1bdaf2fc805e42e2fec946b584a3359c2c7d28c5ccbddb454d0a015e61d4722893557b8a3ae108c31383efb10b7e656b88bb632c373beb4beb148d51c0275370d5a551bf3f77def274aee3f4e63823af9f6834e3e1dd7a8d046013cd923c211e7a68500b87aaef99ff54ef150d51d2bfbe8fb49764e458aa3456124a3ae9de72dae26abece018c2ba46e499b26b6aa7d3578a77586146faceb8712e0b1f5add5648e907d61689a17a0d03167084b7cc0c9a2af5e2507ff838b7cd67f99eade6f56af301f35939388d49e3070b7f57ab299b5a4f4fc3fe7f799be6c407fd91f8533726df9cecb060c694333280d8d597836c5c46125207cdb19e03a5d68e65efb93ffe4bcc95e77f04f0dc56344b259e1df90cba26da926dd37d4bda0520883940bb92695988240c4d4a99c4d357b88063990de27cd6a459584d63ae8673ca4f42144010967fcc9017fa45611066966084b8d793c552970e7248fe95243691b8c82baffd99b7fb3ea01e0ce41b14d3d9efa10a5ec852357145341a92f2aa76614f05dd6098fc08870097b743b28a3d4afcbc2420e7aa9b9272446c58464f88bacdee091014f873e60f998dda8253c26ac26309fe28e65212e24dd827809bfd3c2e6b6c6e0bc057b5c40aa3674e3a2d387adc739f0146f841d3681af04f516b24474b29e345f42497b2625846272ec10a17c41b04b167f50c9621b73d77cedd5ae37e2a071887cff6210913351212a16a8c15e50d22438afb755a4cd608b0603b57e3b0ccce6372e89dd017bf7f89385272c669cb046b04e617536a902a506f680ee5f09be8b1dbd9a7667cc14b6f18fee300806f69181dc45c30a031b36292582e33e89f99b980b6fb16b456ef67806470aab80cb9677c400f5023e30152476d1f3759bdfcd8ee76a9842f2b5ae8f13eed054890e447b0b738596cd34627b13a9551c828186589c2ed6083aabbc88a72b1412c373dec91443c10c656fe5465ba115773c278c7eff218214f28fc9dc7f91529b4d2ac514afb0b352f4715dc115ae69188508f1a19b298b801cd5baa093e8bd1b282448ceee3403380536581fc1742f0cbf11b4b096f19993837b22f8ad9f50e641c57887008adee611cc3c009a6c58f17e8566b7c083558614845606b99d6a2230080ccd2fc7484942fad01718b99a995f6b7b4cbcb7a5a95eb690fe7f2d46b2c12ede08f9d67ab0c534fb15ed23ed15c5d05508712c52896d47cd8f0b0512afe0f7a3c17642436e0c98777a0d11013140184dd63b98aa915074ab9e2baf62d19d684a13236b40d32b5af152843433d25df10a0e7c8a17dca8d49ec9835e37cf58d7aaf640c1bebf5a7e15d8152ae514ec5ff292b415238f4d17bd23e456b2ba63c24be39252622b441d372ff070ef29a4ddea4d85b82c278d1c143271e070ac2700b1abc9bf6f510581ce454c72c84f1c78ab872fe8cce0e12a737fcce8a5cfee4d77d5debbce1c0b8c3bf5bb945617c6fdcaf4e44035155bf46f0f87483392e293f5ebd4f705048b0a9a084a2d4f09578f4a554955eccdacb4e6e0b894fb4be576eacc151fd21981dba466adb60fe62349abde6a0968ae02e75f11bdae823ee7ea0805bfc7d01fe9f94ed0458a401f7bc62ed14b5344bf66042bfda139779ee186c99c38b1cf5394f57ba21e190f6b8f288607ad9ad30de7e14c8141b43d3ac8ee73e75340951bf7defdc44b679cc1c8f370b666f22c032d51f71b1f1fd565e082d7b693a91862bf633b33f4d8cc4d9a3150324d2a9555e0f2ac4a1ec1c47937e858f6c10a4ff95bf09827dcc6fdf22dad594ed99fc7aafdc20a757061858bc2fb42c0caf0f4324fc771ce20e15fe1f67acb76f660cfc1abd568bb870e2fa3418c117aa498932986b9b584bdf160b99ad3349014607721da45aa2ef10748782d9f5e39894c8ef20304d3a855e8a1ba5d992681bdafb25594a3d45106fd9c50ac9cd1ac6849f0797b3fe7f97d16a001c34ea1c888154ee4a43fff076eb0ac702788945d99939d86ba371c43b63cd2d7095dd38553de5b2e0a25f4facf64cbd09a6e307fdd284b9842e3f639a52fca030a1ef7e513a6c90363c46e09c95e167db86cb5e6f8a961399ca5cb042c2151157e2e59124f3e3b68d66b0167e356a969b5e445739d8efdc0b0d244317f5293216b42f6d580d9e6f8cef9ba1c85139556cad8a49a10975e2228129a1fa0567571ebb48df6d6ed80424a0dea5524d29bc3a4415d5ec9598c13dee204582b7638d3812cda9733d1bf20469aeb27652e9e88b94c7ffd5084b17ca3a88bf6a0b95764f0d9278d21562c701d7684a091fbb78f07d56f053c8ccbbee1cf9990e65c14634e7790b6ec9d5e4b6eeb4e6f41b1a88294b83976bf8d1ad9ef3e484a34bdb9040072ddddb38660493aa117d5d8b187b84df32ae8a526f7dc09ae8ca1b1de4bef1a464c9b8845d74d80a1f4b4e8286db2ed1223b7ade3c5b3fcb195b3930a7d9243e63e013a3d69c73dc7a26d3da4bf329c47ca91c41e92d05e510d1f80f2c239913cebf20d719be5a2fc5386e5bd8c5b10de294a1515f4ddd6cbbd058322d45e4a3a8e0a8c3c9b8c731f2dba3f75bc56f4c26a21a0ee4f40a68540df2ef02036f4f473ab885fae6d058b2d2319efef6fbcd9229ba183cb1b11dfc2c7ee6320cc35139a589d172eae3fad1efc582645195f3399f17e16897c378e44a481f1ddae0ad34c66660c4e76934a8a209e160056f060f1354e7fc7e50423700c60a26a4356c8494ed737aff51f996c39527c36e7a45eab67294178634e0e496dbd796ce4527475e897577c8b80de00929f4d2ff88bebf2b5e579bf528c679a72cb892931008fdbacccfbc869f3fcb90364407ba41ad844d794d7c323fe5a0b59a9107cc8906fcd1e70204c9cf6524cdc844cc35ca7c2bbc91b580adec89836f9b5b0c1967a07c43cf0df1958a245d48764999f8dcaff2187b3ed7637313f235adb908b3b854dd5b95fdc5626aca7ed2436d759d61a3968113a861f5f3f4abcad75ac115ab2b3afa374887b9915cbfb47db84b9eaa4d9adabf0fc3a57c1d9cdbe53cd9730cded2a70dfff59d38921e469771db481ef683115bff21f2d5998a2b697d6ea8182caf725060da00e7ff04bd53aff2a248fd5c699d289b4529eaa900df3a9e127c0cbebcdbe56b196dad2aedb68750974b9c179b27463165e5b1a6ee7eeb4b17d6f1ca2df5344c42d3ddbd6dc23730bbde939059b3ae7d4b7a83c47edc11d447b17f8b5f75df520fec4162fe40a30c8cabcbb57724467fd564b82f4fdbbd03bdda2f35e440ff2a68a7fbd4d1f212262aea99ebe7120b692150937f86891e22be37308015bc41cb5b4ffd4ac61fe9ac327834fdf9ad8f1acb578bac76d17f810eb12062c7582d56bc15c93d0a26b02082239dbfec5b969665265d3d17e6ab0e2032533e33ae88b88ae76ee930d340f248cf3370eca5e2f3fff59ca01125a9753a9756313ba746e6025b887bcbca58646a65ba56698a8d229b1ed41b739395bcb5f382a2e63b10138f300bca7e83338c2415a5abc6ae447d2e8241e7730cc452313470528e0bec3d9aaa8e63b0dfdef0ba1dd6051f05e1a29c951ade7377e8eb662863387ddd3e9dcf3511576996af705e8d9c25fdf38d6596e0d0e84ed5e76151a3e31a3efcac0f37d344c14944beac8c7c994a943bdce4533f11a2f18a84a53623d854b8b6ce8208612c33b5ca80c8746bbb7e095338840b30e0b2d55717b625496506e4fba248ea208c4974cb9da54b8aecdd048ce8cb3345a928c85522c99832afd18eea4d2c108973a5a35180a3dad0347bb97285ec3baed9a486e9dbf4ba9d9c8f16ea6b555eba746ef37eab46d6ee3dd754d4094cd9f6f75343169b7e0f95a0b49da21236c3e7ce88993bdf2456f39e5d51e5feb58f9cdce7bfab6cb69902e84ca9c693d1a5c0a0988ee4d81c7137b791be8d3def033424b9cd2e3e7708e6cd48658feff29a9b99c832236a8b346384ccc5a66873c7a9ee12269434b1ec6b3c58f1d36ea6c3341bce9ec6367eacfdcb8e31852e11e4e98a2330348fc6837e36b73fc8782fc820ec8f6538cb4073d9c43208573419fc8c259b1fc7aec879e3e71ae3d8b548604ca3ef038863a451f0feec3b2b6b77ad925fcc1521cf5b8f7ac0c12df3b751733f1a8b2ada8b4da4221e96e38a537e7cb408fa2ec1743eeb1b604a380b4dd12c38e9afb470961e6cef9b863c95f536acda66eb3062ffba07f741053f823ac5629334018a03372d919d458d002448775d1124e67f4439ff66ba31d20bdaae899cfe760dbaf0ada575dc83d4f29cba93d73270b1ce386a12b3c768e3390563303a9bafe0842592a8ecc33d26d2e2a27b116eb71d5bc7d0108eb7066b07d5b9f7b3d3746ca56a2068c79207030736508d39152b8ecb632867a32d50498a2db2c8bc635d3af30f2539e4598355cd217b04c4d30f6ff75e243178d702421f36f4f35f1dd38f21bf47fd461609d51e713e4c394134e2b4eae9c558350b2de8e73aa35ae2539910d3de5bd828b5550d0ae80a8084d21c05af8fc1718c86d74da20c5bdfa8e7cec4bf89f89a969969ad608f59121cfbcf06dc26bb57d1f67081deeedf672923dba6de184b34e4d45582285d7e1b1bcbfc56acccdf60417ed4775d405900c0c6c837fff814dfab25fb5481b6ea3876930cf796e55843125b9abf6de2095e4ba16430697f40f0e1aecdc742424d3731fef3071f93923e8d77cad8e5296662eff750493afc37142d145851069b498480bb24080220b96bbfdeb0c99b17f65de9adaa63a38f999f5abf1ec6b80cc60ce12d1a6931763e20b1a1e8d5ad1405a05eab419361d95894fda3d7e877babcad4d200a1366713468827f0bb87d180170450fd3b8fb5996b313c34ca316f92f9ce51593dda09a51da1eeff51d852ab03b7d144744d0f003ab35ce8f2e81cc08e7f5340786738803dc71b18d3252a8ffa5b5fbff476a7088bc46be219bed568c71c6f548fd7639a7b5f5b602493979c0ad2596f6d6e1fa70f18ed8525ecacbcd1d19caf589bc3ed3203fe55df6a262e3132226578d8da55237dea88830b4a48ee3b526d1c72013773841e6ee4ff207b4e06b3378f64e4d353f841a77ff115c868787c67694833a52e155ff1032ff9038380a9e6624b5b7a685ef94d15d843eef38ceab7bd2ddb63361084df81439f83761bcd1a13ffbea52f15dd874db88183574577c07096382680f9b68bbbda26f6e9011a9c57443cf48c67f85764208fa51169bc3cb46e152fcc4136d5d6a65efb582ea1008a2f2ea8ebb5d64ad268899ff833aed1b95690268dabd87ddc623751b26bb8455b6ce70ce29e656cffe709ed230daa8b0da313"}) r6 = syz_open_pts(r4, 0x20201) ioctl$TCSETS(r6, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r6, &(0x7f0000000140), 0x28d) ioctl$PIO_UNIMAPCLR(r3, 0x4b68, &(0x7f0000000140)={0xbdf, 0x4}) [ 145.661719] binder: 12171:12172 got transaction with invalid offset (0, min 0 max 0) or object. 03:00:46 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:46 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xff00]}, r1}, 0x14) 03:00:46 executing program 6: mkdir(&(0x7f0000000100)='./file0\x00', 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x50800, 0x0) r1 = dup(0xffffffffffffff9c) renameat2(r0, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000080)='./file0\x00', 0x5) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:46 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f00000016c0)='/dev/vcs#\x00', 0x7ff, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000001700)={0x0, @broadcast, @loopback}, &(0x7f0000001740)=0xc) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000001780)={r1, 0x6, 0x3, 0x1, 0x1, 0x80, 0x1}) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x10080, 0x0) chdir(&(0x7f00000000c0)='./file0/file0\x00') ioctl$SNDRV_TIMER_IOCTL_TREAD(r2, 0x40045402, &(0x7f0000000040)) 03:00:46 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae46, &(0x7f0000000040)={r3}) 03:00:46 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x7009000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 145.740194] binder: 12171:12172 transaction failed 29201/-22, size 0-8 line 3030 [ 145.774838] binder: undelivered TRANSACTION_ERROR: 29201 [ 145.780462] binder: 12171:12172 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:46 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) accept$packet(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000340)=0x14) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000400)={@empty, @dev={0xfe, 0x80, [], 0x1d}, @mcast1={0xff, 0x1, [], 0x1}, 0x346, 0x5, 0x96, 0x500, 0x0, 0x190102, r2}) r3 = syz_open_pts(r1, 0x20204) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) ioctl$IOC_PR_RESERVE(r0, 0x401070c9, &(0x7f0000000240)={0x5, 0x0, 0x1}) write(r3, &(0x7f0000000140), 0x28d) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/uinput\x00', 0x1, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r4, 0x5) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000040)) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000000, 0x10, r4, 0x0) r5 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x3, 0xb8102) recvfrom$unix(r5, &(0x7f00000000c0)=""/149, 0x95, 0x2120, &(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e) semget$private(0x0, 0x3, 0x120) 03:00:46 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:46 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe]}, r1}, 0x14) 03:00:46 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:47 executing program 6: mkdir(&(0x7f0000000100)='./file0\x00', 0x2000000000) r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x4c5f781a, 0x0) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000040)={0x1, [0x10001]}, &(0x7f0000000080)=0x6) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:47 executing program 0: fanotify_init(0x8, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:47 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x40049409, &(0x7f0000000040)={r3}) [ 145.923510] binder: 12231:12236 got transaction with invalid offset (0, min 0 max 0) or object. [ 145.946893] binder: 12231:12236 transaction failed 29201/-22, size 0-8 line 3030 [ 145.968442] binder: undelivered TRANSACTION_ERROR: 29201 03:00:47 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xffffff7f00000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:47 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:47 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000]}, r1}, 0x14) 03:00:47 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x309100) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) [ 145.974438] binder: 12231:12236 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:47 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) utimes(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={{0x77359400}, {r0, r1/1000+30000}}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:47 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0xc0189436, &(0x7f0000000040)={r3}) 03:00:47 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x0) lseek(r0, 0x0, 0x3) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x20000, 0x0) sendmsg$kcm(r1, &(0x7f0000001140)={&(0x7f00000000c0)=@ethernet={0x1, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}, 0x80, &(0x7f0000000040)=[{&(0x7f0000000140)="75a80a045876bde5e230d1f2abf5d4b92fe1bf7bc29386b779b8ae2fb6e983c1022a28e8f3c4c44aab89acf3b117ebbf1e901d645dfadf6baa5a4c65ee2f54446fa24972e1a1f3d2d71b80aec6ee4c6fd58cbd6db8848de8d8dd2e76c2fbb49597b1b66c08174c6de01eb7632c83230415fb65cc90e9817f4804d0884475f8cde58bd53d04e30f5d9316937800aaaa5ce863a9bc2612963d5584a2487f6726efafba839a91dd8cdca359e4cbff543188ae04880f537d2a3d5e732a691e1b7fce92477f43bd3d50e9059564846fd4a5c701f3ca4f5b5ef53dfae7d17a6587e2b2810a8cdf7184e3ae9d8308eb2c5f6a2b57a5cd5276b420ce43ad2e831aea007dc0c03c88d945333cc5ef0bb99ad13f2926445f8f9141f91d1f3f1c213279e5c1e06a25cc81cbd5ecdcc8894d0383daf294fcde4ff6401ec4b5ac1908a8bda0d8a7ddb178b5ece5837a76db2d711f2fe30a91ba3db6bb825f7f6eb7be4feee018740615e37f41753e9375d685a0e4056df0b83ea6aec640262e5b20bb14649a9fe95b1573498cd6c8712c9051a27c1209c7c8b5d3d647812a2ac1f283f6e318fdbfc6b2a27b07cb1039964141e16fbf233a51fcd82deab292290cfa711aae5adf633eca84052263847d76169d4f417b206906adeb7e9e1179349edd86eb23f2ade4b8764c90e418668fa426a994d1b4f678ae6ca21410b370de0cfe789109f9d528cd0a423077d51fbacbda2d3ff19384fc9cb46b047964f191c5d066805b0d1d8714bcd1cc8a8aee94eddabd674865cbcaf2fe52536505205a813f25b7de14bbb7e874e88c7f879048ffe05730b399a5b78447a49541eacaf721fb6aa8c63aa58b159612b374a16490516163b424a80ff93482d87706f9eef642a58d6f24a6089819a1326a7210ecafdb4ed2d20023b92f06c0736d28f88023be917f80f6c081ac103a9774c9195845ab6fb9714353ed8a7c346b2609efa4ed670d033d950557d4f1be05f07a5893b1e16f27f53eb370dac80a5a6d87a1ab884eff5a13470e60ab3f43b1ce8efca590c717de319580da108d749c5e27226eea32eca511bbc064b1fc48fe80a0ed57c9c2d7feccc391a8d9b1dc5dc05ab43393e534f849bfbf26cb7bdf71a954636986f6493f3b26230e1152641730c1c785d666683f444afbe6d556d270d63614a3a3636d6c8521096c60853aea9dac4eca3d7682fa4231305a65f40d21eac97eb0b903db953be8ef60e9eba52754ad92c0a4ad7293dc9ae6887a1f0103a34df3d5b78090a91149163b04776997738937c698c8e4f78f72d8cb96e07f765f52ac73f6feec039eafd9ca12664df152f62999c7fd69bfa8525cc7f4a060b3ad9b47821ac4edaee84203f51013986ccb30a086eed19c838b90dd9dcbef3b53e6435013d8199fa1d62650d62861121af94fb82766834b0ec249933fa1c330f0a32a385c042c73cd15d1defbb5aed476e932331763c434f2ad26a2f5e6a335e28023de32a9a983833ac4df282c78665d10bacd9708647d35632dd307c7879ef4fc4828572afc0ffc11f940749542f9e6808aa7f3afa2dbff757ff632396ac76a6172cc099518a3c2ebd5b52df6195f119b4ebb1075896a5bf049057775a5bd71b2df9c27ad7e6adadc4265b07b79715469a86d4d57f7a647872604cd23785ff517fa197fc5792015aa2817904fde8515b84a1da394f26894c9d95465e0a9790165f35bbaea28601de4506255fc7678d8baa68a3ec4c0515cd28e4a9b0eb14503dfdc1c50623ca36e84af490da38c62a87cdfc374d16a981f9896a7fce663f887e413a8fed2d63cbc5115371dbbd62f56f992cf25c41230b1631a28b2ec73b3c4f041c5e4f8d2eb293061977cbef0fda36a22cf6780a80497cb49258b68702a34ec0c605e5f1f43aecae408e3953c23fd1c1eb7138916a220b7d15df170de4079866de171b587a0a8c20727d0e416c888c416a65feec911ed81abfc81a8d58b0965feb84107bfc9a581145816c9d9bded337a65728d15beaf24d8293a074de9488a7e4b10b1c4632b69919264525d63fda165c457f547736246db837d845d006fde36fad7a76f87a47cb9393d5185d1cdaef8b4ff675dbc3cb7cad9dc75fd7a1c25ad7c42bf546962a6e8c94f127848b98c16a2b518463332e15c7ae0ed2302c2fb2852ba72bd6d37cf7161ba6334544b7d0eac70fb3b95e40faedd2bbe1c89dcf24114e9eab1c018f4661039c685e07ff590c8b4b5945676b90efe636cf944e4e6bb36a7811f4adabd1b1f4eec7b8b2484a533c7e1aa2d05f85d23aaa7c52cc628547bbc3ffde4b7f195cd129f45542aacb9844535e9794ecf64fc0e7319f949aba3495008714d4bb160d429fa0e339cc43396c0a684f52dd3551b1f9d68ceba365bd18f6f9c12cfa8644cbe7c003369d23271fbb28dc3d8aa60c3cccf1ac8c56f6d6e596f99095f38fc087997e46e9bbe9946706111cb78ee8130afe30ef683ac4b1f627dd237987f1d7a5456e652e4c592fad339659cf188abb6ecc8726d5fb3a695672e395cde5bf9edcabf7338ba0c19cce7acdb52371023d74263dc35ba3fd8c896985b597a347104d9a137f443827d80d9a93c0e92a73f011eea0c88bf5b12e02af05903da26031ba2efcfa2c0c3aa2f0711193fe271641805b1e4026f372da3069d1d677f1a2f7bdf80d61c2659f77a3fce6fae47d21a48b986530a456b729d7c172013aaaf66e1bafe71bc646b7a0bcaf80c091894d7ec3c99244320a92491f5dfe933bf11db38b05bc065ebd8ed6e5aa611bdcaa10656bc9cbd79bad7b4a32682533586e0d230a7e298a28ddc15cd5c2380868b0a357eb04f23edd49976db4e302ab74d8c4698f989a1fc29fd11bdac783c815b70a85782a13f2fdd6211a2ac989c9105821b0f084a2b6f0fc477fd8baea29ca2b9de777127bfe317f107f07457347fcff04a6129c734a9e4b2f4d830f3549811440d4e79d71b5319f1febf3f2e139fb57b718e149633c514d6fdc7f971248be437a0e409c5f2929ee91664a1c57f510e54d31f7b3a06307f7de39d9e413302762df75b3afb0ab30f686ee064f18e87a2aee2530f3e67d2ffd6342653116e97cdb8adc94eb44356a31fa2228cea43e7c634b325d8b72549c8c5dceb73a00def2c1d3585e07688878d3f54a9ae578ac9ae5f6e18f601f1e726735bf9d810fba104eadde0a4c1dce14e302565d5ce71cc38ebde5e78bf82bfb1082f3682d325588aa2a8663561575b3285cea12d488a0b2ac0bc66d482d5a9010fd30c55395c753c6645e8df2312f1de7c33d16d25b802d59fc1580e56965aa1b03877518523ac6d5120fa4438beb85630d15656022bed172ebf62a46029ff18abebd2f9a5ca042860315e5686049278ba6b64f633cd02e7dd256aa37cfeac9fb7b6fe107d18b761322b15835870c16f58467a36f99bad37e732d1fc71ef4e358de8478aa000202fe1b0013e1bc7272d11b65f17ac1449bdd1d450b91d5704194d4eaa34a62925592b4db9d7bdb99480f668e28991078d095b991405b792afe084ba93781d06d29cc9a8289f490b36539811d811f924a6516bcc98df157e404dc93cf05ee2d789600fd81bf89d02a268d69925166b06e56a66db59c2f6c7433420f429473f0555ac3017790392fc8f80b6b2fa8ea86ee2550e96edca77c69fcdf4498ff5edac430d0a1e71a731446af4188b86a87c3d7039b4e91a83e534e8b568ed7ece9283875ec0864104e48f0762294e986a9536d08643703aa881f61357f0b8f71399d070bbc6559692625f159da6a82a5544fde7a7ac9355dcb70254736331766e8b92adf24536aba918c4093f344c27769e3fb59ca070c49871e1dbfd2ad9b0d03b38f9815eb5dd15abb0f6ed30b2f06fb4f738792c4ac9f3dded391263940724bd937dbb01b6d30f0f6aa2174f651e8506a5a9807e1cb766071c0b0c88be64ea7f91f25fff341a4c226b215fefecc9daa1ca9ebe1435b0d31de6cb6845c20dc5245b32039febbbcf4a7d558288caa281d208b4b41a490d7af47a2203dcaf8a0b8a4a73cd33ee3aaea75914d0f3591f5e66bae42fec6996312af1f572244e0d59cdd4c713e21a1e7cdb41676d84091bc7599dae471a265ac4da8d91163535a4d1c70b7236cc2b4f5dba72d5908ac2251ccb9ba6107d1e63ed28bd01c5d61ef9b078f16a38c8a6d88d9a70588445ba87789978a9dcb1a7da0bd318ddb52b0746cc41a26815cdfec64b9c035996698ed0e49e3e1fd7a6c9585913584fada32ec36d876b596aa542ce21639e5d9258decb01c06aca65edd3b345ff5d9f2fff97f0bf8527d48a317f5bd32e2e491dc3e7d510ffc94ec3334fed38a426856fad99206f04c623c90bce0c6e8cb166c1d1284b9eccb1648e9cb4f17262fa5eda3d1c42c087a4a47d5d42e957862acdba14b5c08430309cde99cbce502de7a6de0ce3b80235f01af40707613433cd59cc0c4a65795fb33f2eee3bdc14431e758761ad515accae4ade5f9329ecc1690e47c830c44d40a96181cdb9f6c7235a40c9d91ab713c80ea8b02eefc6953192b119515cc675ede92b1f22e22abec18325c172c48919fc20d66962f3acbe9ada7a0603c371dc031129ab8507a74842af5b4a4e60a169b50ffae62c3d5bbbb928f6f555ce84086a6f1205fefa1f8623b812c0c3cf4c56936e5d109b987ccc0a089cd47c270d8eff3ac375fbf617ccb4092c74f774b81148f84aad78106599e89a14b6229e09d4663c405014d4c2ea5bc6c4ca56d84c08314a6c664570c401dd0411ae3f5ba149653025239a15a9f07391365579789f4015228f9c13b318f0bc4e4796cad5be59ccd3ae2f2ab8da7e1aff359e8e190f89d492b6df1aaa0b279299a1fd51042e2363816365286c0e1e66e36deaf7533c4e98b376947008689e20382a3323f9781dcdad3d9519c520f0862705d6685fb5944ab5fc0d3a405f05ff29f0a9cb8d8be3b7ab68f190bdb7864c2cf0b03ca89438e77548f5d7d46562bb173fe60c747d6d055b2077048f2a8478baeecc144f7efcf9d5a8dbacd687baf67c3d587a4b48e5cf3d4a0eb775a34fe4e7bdc7dbc2f34e31674f9173c141b3d00ea09502c758565068cff176d06979f13748b8e4e50b9140c0a6e592e2f62588b9591ca821da0d73fcaf5939f9b6c35f7c331045301b26713abb56a2f5e9d71fbdaff93c4f889e0a64e5c2eb00ecbc1741bef52feb45c220f09dbafe3626673081c107c7dab7dc3a392153930b1d6e21f173de1a94c4b6c808ffc1a711c49548349e819fb8d76c7e35920f603e589586c6173716dbfcae0ee8a1459c7bf954bde0f31120cdd9154889e3eb491755a32375b052571ce85892018ac785baaa78ef5a73b8e100f5d5e249f715afce9b89bcfbe01900c387467bae0b4f66ca255b172ad34028dbc46be625f4cabdd695493d1b3db01c03644506a6a7ad0263343e295feec18b4d9ef6605a13d4981b0983632b58eff6a4310d664a4efb2ed28b23a2e72d9e8668ed750052c5a5dfb16819de9b791decf4776d7bd10c4bf1b6c5c0cbfb51b03753bf1b6135b0b64cbac29ee14b31a66df561d19655115ed2519ad4572cf7e09338c0abfe6041b28fc020822ef44c17df13e3e927a7a067c3570dfa73339fb23abbde2ae6ed2b9ad7510237277f8a18f93ff8ec8e0ed1a5c3782f14e4cd5ce10dd535c982bc17ccfd77f91453f27f822b3057aea8fe68fd96553fe83cc5720257863f4bd9f667b23494d8115c5c446b0c1d4e8e8958de671d186cbc", 0x1000}], 0x1}, 0x40804) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:47 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:47 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}, r1}, 0x14) 03:00:47 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x43000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:47 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:47 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x0) 03:00:47 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') listxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/9, 0x9) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:47 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x7, 0x101000) ioctl$KVM_SET_DEBUGREGS(r0, 0x4080aea2, &(0x7f00000001c0)={[0xf000, 0x5000, 0xd000, 0xd006], 0x7, 0x28, 0x1}) r1 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000400)={{{@in=@broadcast, @in6=@remote}}, {{@in6}, 0x0, @in=@rand_addr}}, &(0x7f00000003c0)=0xe8) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000240)={0x0, 0x82, "e1346ec64bb1396646882e3cca8b0c9fe4dcc59eca006ca545d49585e6a93b8711f539ba2157e6d700da60791b6c77a744e4e356e24f65a144ce8fc02921f5d678c76782de035174d0bda5b0354656a3c28ccd529755b92077150223df299615f9465ce30c92e7c951fc09b4c460d9afa38d971b3c0753d8b70ec3f8292045fbdee4"}, &(0x7f0000000300)=0x8a) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000340)=@assoc_value={r2, 0x9}, &(0x7f0000000380)=0x8) [ 146.166338] binder: 12283:12284 got transaction with invalid offset (0, min 0 max 24) or object. 03:00:47 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000]}, r1}, 0x14) 03:00:47 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0xae41, &(0x7f0000000040)={r3}) [ 146.209107] binder: 12283:12284 transaction failed 29201/-22, size 24-8 line 3030 03:00:47 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:47 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x20800, 0x0) ioctl$TIOCNOTTY(r1, 0x5422) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00005befdc)) r3 = syz_open_pts(r2, 0x20201) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r3, &(0x7f0000000140), 0x28d) 03:00:47 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xf6ffffff00000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:47 executing program 6: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, &(0x7f0000000040)) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000140)='./file0\x00', 0x20) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000080)=0x0) syz_open_procfs(r1, &(0x7f0000000100)='net/if_inet6\x00') mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') [ 146.276498] binder: undelivered TRANSACTION_ERROR: 29201 [ 146.285159] binder: 12283:12284 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:47 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000]}, r1}, 0x14) 03:00:47 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x200000, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}, 0xfff, 0x8, 0x800, 0x3, 0xaa89}, &(0x7f0000000040)=0x98) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000180)={r1, 0xa68b, 0x0, 0x8, 0x80}, &(0x7f00000001c0)=0x18) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:47 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:47 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:47 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4010ae68, &(0x7f0000000040)={r3}) 03:00:47 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xa00000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:47 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x0, 0x44002) ioctl$KDSETLED(r1, 0x4b32, 0x6) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x402180, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00005befdc)) r3 = syz_open_pts(r2, 0x20201) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r3, &(0x7f0000000140), 0x28d) 03:00:47 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') r0 = socket$inet(0x2, 0x80002, 0xffffffff80000001) accept(r0, &(0x7f0000000000)=@nl=@unspec, &(0x7f0000000080)=0x80) [ 146.444680] binder: 12342:12343 got transaction with invalid offset (0, min 0 max 24) or object. 03:00:47 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = accept4(0xffffffffffffff9c, 0x0, &(0x7f0000000000), 0x800) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x4e20, 0x400, @remote={0xfe, 0x80, [], 0xbb}, 0x3}, {0xa, 0x4e21, 0x100000000, @mcast2={0xff, 0x2, [], 0x1}, 0x3ff}, 0x7, [0x5, 0x0, 0x4b, 0x101, 0x9, 0xd75, 0x6, 0x1f]}, 0x5c) 03:00:47 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:47 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80]}, r1}, 0x14) 03:00:47 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xffffffff, 0x101200) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) utimes(&(0x7f0000000180)='./file0\x00', &(0x7f0000000240)={{0x0, 0x7530}, {r2, r3/1000+10000}}) ioctl$RTC_RD_TIME(r1, 0x80247009, &(0x7f0000000040)) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") socket$inet6_sctp(0xa, 0x1, 0x84) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f00005befdc)) recvfrom$inet6(r0, &(0x7f00000000c0)=""/103, 0x67, 0x43, &(0x7f0000000840)={0xa, 0x4e22, 0x3, @local={0xfe, 0x80, [], 0xaa}, 0x4b}, 0x1c) ioctl$FS_IOC_SETFSLABEL(r1, 0x41009432, &(0x7f00000002c0)="449a51f9c319772650522733c728c4fb1e8fd7f6ec971e37633cdf179bd0bebe266596caf8074288bd0da8cef7688c32f6be967413563a07514b36764ec23f226ff7944ab8f8c158ca6573d13c2c452da48c8d07646a34de7d610932b200f0613be64658a0474a4d1b5bd60dd741259a2157b23ec1f0bd09aa5ace52d17ee49610208135d6c8b81ca3c06a0ed858e298f778b8ea66be53678fc7c1eb8cebb89a3e3dee8c6797e793510ae178fa26cf1227abbbdf1781f288de3e5997a7e390c3fe725619c76463fcf97d18f0c75a336d4f2eaa11765c381a9ff3e784f33e18fcccbfb306d4bda69b1085bde9360f72a35391c21aa798bc0b0377ab7c5f5af246") r5 = syz_open_pts(r4, 0x2) ioctl$TCSETS(r5, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r5, &(0x7f0000000140), 0x28d) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000400)=@security={'security\x00', 0xe, 0x4, 0x3b0, 0xffffffff, 0x0, 0x220, 0x220, 0xffffffff, 0xffffffff, 0x318, 0x318, 0x318, 0xffffffff, 0x4, &(0x7f00000003c0), {[{{@uncond, 0x0, 0xe8, 0x158, 0x0, {}, [@common=@osf={0x50, 'osf\x00', 0x0, {'syz1\x00', 0x3, 0xf, 0x2, 0x2}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x3ff, 0x7, 0x3e43, 0x0, 0x0, "365ee6fda897be21fd5ce53ae0e447af51b09f691e7c86cb7a4c7ff881010f10a676c998ce27226f0516065d7e3d40a92f0196d324efd42a75c7ce40b731a6be"}}}, {{@ip={@rand_addr=0xdfe, @remote={0xac, 0x14, 0x14, 0xbb}, 0xff000000, 0xff, 'bond_slave_0\x00', 'veth0_to_bond\x00', {0xff}, {0xff}, 0x0, 0x2}, 0x0, 0x98, 0xc8}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x5d1b, 0x1f, 0x1f, 0x1}}}, {{@ip={@broadcast=0xffffffff, @dev={0xac, 0x14, 0x14, 0x1a}, 0xff, 0xff, 'veth1\x00', 'nr0\x00', {0xff}, {0xff}, 0x21, 0x1, 0x70}, 0x0, 0x98, 0xf8}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @empty, 0x8, 0xb, [0x29, 0x32, 0x40, 0x0, 0x2d, 0xc, 0x5, 0xa, 0x40, 0x24, 0x18, 0x6, 0x9, 0x2d, 0x36, 0x36], 0x1, 0x4, 0x400}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x410) 03:00:47 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x200000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:47 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0xc008ae67, &(0x7f0000000040)={r3}) [ 146.513246] binder: 12342:12343 transaction failed 29201/-22, size 24-8 line 3030 03:00:47 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000000)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x0, 0x0) bind$unix(r0, &(0x7f0000000100)=@file={0x1, './file1\x00'}, 0x6e) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x4) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:47 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:47 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00]}, r1}, 0x14) [ 146.580938] binder: undelivered TRANSACTION_ERROR: 29201 [ 146.586612] binder: 12342:12343 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:47 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x4) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000000040)="31155317ae37947962de48754622f57e728f60c53050a0d013d8231bd018db94c02cb7d48b92bfdfbb2c1b13d8aaac5461fc579a222e6b0cf8595161279bb6010265d38549fcc57d25d8a36571d96e852c6bb1cb268f361f4ade0e7aed7ec1aecbdd1826014821ef7ed08c0a40ad46289aeaafd85d388a2fed70ba8c") 03:00:47 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x1, &(0x7f0000000000)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0xffffffffffeffffc, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) 03:00:47 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:47 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xfdffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:47 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:47 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x101000, 0x0) mknodat(r0, &(0x7f0000000040)='./file0\x00', 0x8, 0x6) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x0, 0xba, 0xaf, &(0x7f00000001c0)="12ed80c9c24692a61e5567abeac72183f75c7058430d2470d8b899bf2c53e9f6e8ae7dc5d0bb18654e7ffd75a1b678064de5d7c7357419f918d8ebf4aa078b1cf9a2afde0ff0a980610b4dcad8297f60fbeebe915d5e033d433ec90fc5f78d5ca823565bdd095d3aa964c2ffec06f2d7e7498bf0b551ee31c6105a146c0df38a3c979ade8e9c570ffb11b8acc1788e917b60209c5916ba7e9dddf48ec7d677cd0fc9317601fd020b43470c6621b88943dd262adf8c1778baf4f1", &(0x7f00000002c0)=""/175, 0x80}, 0x28) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:47 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80]}, r1}, 0x14) 03:00:47 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = open(&(0x7f00000013c0)='./file0\x00', 0x40082, 0x40) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) getsockopt$inet_sctp_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f00000001c0)={0x0, 0x401, 0x6, 0x0, 0x0, 0x10001, 0x10001, 0xfffffffffffffff8, {0x0, @in6={{0xa, 0x4e22, 0xfffffffffffffff8, @local={0xfe, 0x80, [], 0xaa}, 0x8}}, 0x3ff, 0x8, 0x80000000, 0x8, 0x4}}, &(0x7f00000000c0)=0xb0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000280)={r2, 0xbc, "40453fca6bc36ffd0a5ae09c872155652a8013963a2dc117bc18c0a62d2bf2b8c955ebef365495e7a66f4ac11dcbd554ae95534ca3ff5345af767785605060a6617a8f2fb9d931157e481f8e9c2a4087c644e29b703ead9509912c97961e5123c8ce7a9c0d4752313a02624324b5f4b6942b8c3b9fec278893b023455a56a346de58d864dc6c5071b85ea5d1a34160d41bb8bbf6a711a1581049fb5b9863903a2ac4eb2d6b300167a293c68d11f15549195e217068fa186801e22a16"}, &(0x7f0000000100)=0xc4) r3 = syz_open_dev$usbmon(&(0x7f0000001400)='/dev/usbmon#\x00', 0x57ee, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000001440)={r1, r3}) mount(&(0x7f0000000000)='./file0/file1\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000000040)="2e3c5df30e00000000", 0x0, &(0x7f0000000140)="fd277b2b6faa9a5f7481a4c78cf25d35e039a90d32c4f8d36208b7e38796d0e2702bf5c9a7d992f5f54c39d020342bc5abc4394d024f8ae6252618f7e40b8d4d5aeaad087b8ddb9eeb01e0d9cb902d572a49f58f8d6a3cfccf678bbccde1952f97b78ce396b30a3962") 03:00:47 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4008ae61, &(0x7f0000000040)={r3}) 03:00:47 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x1d80000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 146.776593] binder: 12416:12419 got transaction with invalid offset (0, min 0 max 24) or object. 03:00:47 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:47 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x6, &(0x7f00000000c0)="1405795ee30e2d989502516e6b3732bf78761f943a60651a28ae5e3a3f3bf956db0ea2b063434789f9dbddecdc126c7c3db9e09e867da6ee4f350c97f09ecdd5a548e9119f38fc19767412a54b656c5da6b5580027348879c2d1c6074cee5c324207b4e413053d8c0c9c670dfbfd32a17e44dc640dd5cdfac59b963758c10d636ca59d828802eec5d168f5b432075ee8159a") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x100000401ffd, 0x0) ioctl$EVIOCGBITKEY(r2, 0x80404521, &(0x7f0000000040)=""/44) ioctl$GIO_UNISCRNMAP(r2, 0x4b69, &(0x7f0000000180)=""/97) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0}, &(0x7f00000002c0)=0xc) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000300)=0x0) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f00000008c0)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000900)={{{@in6=@ipv4={[], [], @broadcast}, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@remote}}, &(0x7f0000000a00)=0xe8) getresgid(&(0x7f0000000a40), &(0x7f0000000a80)=0x0, &(0x7f0000000ac0)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000b00)=0x0) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000b40)={{{@in6=@ipv4={[], [], @remote}, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@local}}, &(0x7f0000000c40)=0xe8) fstat(r1, &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000d00)=0x0) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000d40)={{{@in=@remote, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@remote}}, &(0x7f0000000e40)=0xe8) getresgid(&(0x7f0000000e80), &(0x7f0000000ec0)=0x0, &(0x7f0000000f00)) r15 = fcntl$getown(r2, 0x9) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000f40)={{{@in=@multicast2, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@rand_addr}}, &(0x7f0000001040)=0xe8) clock_gettime(0x0, &(0x7f0000001280)={0x0, 0x0}) clock_gettime(0x0, &(0x7f00000012c0)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000001300)={0x0, 0x0}) write$evdev(r2, &(0x7f0000001340)=[{{0x0, 0x2710}, 0x2, 0x5, 0x81}, {{0x77359400}, 0x8, 0x9, 0x3}, {{r17, r18/1000+10000}, 0xfb5, 0x9, 0x22}, {{0x77359400}, 0x5, 0x3, 0xffff}, {{0x0, 0x2710}, 0x8, 0xfffffffffffffffe, 0x6}, {{r19, r20/1000+10000}, 0x3, 0x1, 0x6}, {{r21, r22/1000+10000}, 0x1000, 0x0, 0x6}], 0xa8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001080)={0x0, 0x0, 0x0}, &(0x7f00000010c0)=0xc) sendmsg$netlink(r2, &(0x7f0000001240)={&(0x7f0000000240)=@proc={0x10, 0x0, 0x25dfdbfe, 0x10000}, 0xc, &(0x7f0000000880)=[{&(0x7f0000000340)={0x290, 0x18, 0x508, 0x70bd26, 0x25dfdbfc, "", [@nested={0x50, 0x67, [@generic="34a1bf46f903094d15b52280fdd6af001d055d2e70e1fe9e5f3a0cf511088a02192f50bed829bec49be2adf7ba0e4b9d4e4694bde1502aa952f05e171da1b4d1b9c6a4bfc669e202a9"]}, @nested={0xa8, 0x6c, [@typed={0x8, 0x38, @ipv4=@broadcast=0xffffffff}, @typed={0x8, 0x2a, @uid=r3}, @generic="01d15706b95a34b6fc1994c494651b1dd84c4f7cb0889be92761943df01a92596125a77542e4e4513d0fe8063499805a5e499338515af6e324200545c5c31b89ac4081ff1d9c7a5b3f8e5121e083d987e7be614cbb6d76356112082037bf1102a6635c5333158ca47d96baff8e8a43", @generic="ec32b7c656f5a1c044b6d1865154187934aa207d2ee09e5e1c77c724b55d65f8f8edb99a"]}, @generic="94f08c7048f5b28d3abc3f831f35e929a450ea6335d2d0604f06812907a35b383a8ba8985429cf1963ed", @nested={0x15c, 0x2e, [@typed={0x8, 0x51, @fd=r0}, @generic="1701e4fac0bfbe104b8191a65cf0a3eabef15264d279258b17e71363a8b8bdbcd0b49306046e9562ede2948bb14c0c380c89bb673db4ad6fb335de30a20d86252c236ac7a882beb83c80fc2d9f214a8d81a0545f5848f386c1495e13dde2cbd030b7b31f57f6a5f7f8796b27fa798689e6de61bb1d8593ff7dbeed4d9ba76b10", @typed={0xc, 0x89, @u64=0x10001}, @generic="1ae7304ec2fcc714bf3eceef08f11767a0f219ac28f0f905e2018d3f84b987f574891a56b17cef", @typed={0x20, 0x18, @str="766d6e6574312173797374656dc370726f632a6b657972696e6700"}, @generic="41afbcafbc180df3efe6917102669bede0e959d2f3cfc6952220cee6aa1f49e576e06a0d04cd6b377a9e34ffcdf07d405dfae8040ed57333cc7e68555d0da848ed61336270d960980cf91ceeabd1ed0d8f8dbcc4c90a7810e49da3d74f9b53cdca6a0c91e7079ececb527fe574c74ccaebead3a9", @typed={0x8, 0x38, @pid=r4}]}]}, 0x290}, {&(0x7f0000000600)={0x1ac, 0x1f, 0x400, 0x70bd29, 0x25dfdbfc, "", [@generic="c8b679d882122f0d872e2c149d36d8df9cd79c36b3b49d848a9f2493cf8f2915331339d7fcc5736770634f60fad94474a30c141a0a27c6515b0d66c87674a6b6d10cbb7de4c896134b80723cb059b1c7e3c61921528f500b1229c826565354715dc67cc49cf4623df52921669bee67836e0294b02a484288b7ef065a1e03f371fda634813c45aeced5a64b6fd858c79fc195610f8fc07015e530cd98b628872d0a5c5d70cf52b992e078a93d68b48c787dbcd04784c487fffabc26f37aecfceb8968eb74ed7297dd3b08cebf7e1b340779236843d63bc1f4de4eaee6aa9267bc", @nested={0x28, 0x27, [@typed={0x8, 0x11, @fd=r2}, @typed={0x14, 0x50, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @typed={0x8, 0x44, @fd=r1}]}, @typed={0x4, 0x1a}, @generic="985539aa98f3bc20f5901c1cd3c9d6d4ff2a062bf483eb1883b0d67c724db4de91449828166eb7f17e3c6c1c773c1483ae50373a6e21e5fb07a63490fa09198c33a66613ce2c64075b9f3cb8e58fcebc8696ce7f51e30d87a1176d24da3c026ae36a2e0c90c259b59b9073680777b2b887c7423fe57ae3385aa4eeec3adb37ccb8a65953f5586432c55856d0ded028db"]}, 0x1ac}, {&(0x7f00000007c0)={0x8c, 0x16, 0x100, 0x70bd2b, 0x25dfdbfd, "", [@generic="a262b8872a22eddba680c56ebbc280ab89ba5a9792e1c3b2e839cd82e9a03ff4c29c43a32c3f353b4996eab868daef448fe09b4f6221e3aea24e994aa5cf50a21d43f99eb20a00088bc464bcc51de4ccf524ad2f961dc64a5dc0e1d4740d145e50148fef57e52025946c9d684c", @typed={0xc, 0x26, @u64=0xba2}]}, 0x8c}], 0x3, &(0x7f0000001100)=[@rights={0x38, 0x1, 0x1, [r2, r2, r2, r2, r2, r1, r1, r0, r2, r5]}, @rights={0x20, 0x1, 0x1, [r1, r1, r2]}, @rights={0x28, 0x1, 0x1, [r2, r1, r1, r1, r1]}, @rights={0x20, 0x1, 0x1, [r2, r1, r2, r1]}, @cred={0x20, 0x1, 0x2, r6, r7, r8}, @cred={0x20, 0x1, 0x2, r9, r10, r11}, @rights={0x18, 0x1, 0x1, [r0]}, @cred={0x20, 0x1, 0x2, r12, r13, r14}, @cred={0x20, 0x1, 0x2, r15, r16, r23}], 0x138, 0x4000}, 0x4004004) r24 = syz_open_pts(r1, 0x80000) ioctl$TCSETS(r24, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r24, &(0x7f0000000140), 0x28d) 03:00:47 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0xc143, 0x0) ioctl$PIO_FONTX(r0, 0x4b6c, &(0x7f00000002c0)="e907bef77bb17e3124da9f94476f6bfc7b745636c765f30f2a46e91c5afbe64bfd2b1c6f0349f1b0212ba48c3f6b2e3469486bdbea499aaf979a01fe9f991ec5ad309379673d428316fa9cec2ccdba4c08dbffd05e4d046ac2ccd38c85ee601bbd1e48b148778efc4e03d32027e4dc5a0544780f4a7e5e8f4fc39bdca2867d35720ebce6e4a8b66041d4771002ffb7a89cbbf4fe6f99c5c3c5a27a77e86bb860e8929d0adebeae1377e8ac1c2942e9e9bcf47689feed130c511ca9a6c2206770ce93cfe8cd3c9b33c6998a8a22e8c7dee7f6e438bf0bcb8134") mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') [ 146.828984] binder: 12416:12419 transaction failed 29201/-22, size 24-8 line 3030 03:00:48 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x400000) getpeername(r0, &(0x7f00000000c0)=@in6={0x0, 0x0, 0x0, @remote}, &(0x7f0000000040)=0x80) 03:00:48 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe]}, r1}, 0x14) 03:00:48 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 146.883873] binder: undelivered TRANSACTION_ERROR: 29201 [ 146.889861] binder: 12416:12419 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:48 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x6402, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:48 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:48 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) unlinkat(r1, &(0x7f0000000000)='./file0\x00', 0x0) 03:00:48 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020aea5, &(0x7f0000000040)={r3}) 03:00:48 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x9, 0x2, 0x5, 0x7, 0x0, 0x7, 0x800, 0x4, 0x5d8000000000, 0x39e9fa94, 0x3, 0x1c, 0x7f, 0x0, 0x7f, 0x7, 0x9, 0xffffffff, 0x0, 0x2000000, 0x8, 0x8001, 0x8, 0x101, 0x1, 0x9b1, 0x1, 0x1, 0x4, 0xa317, 0x8, 0x1f, 0xf, 0x1000000000, 0x6b39114b, 0x7fffffff, 0x0, 0xe60, 0x4, @perf_bp={&(0x7f0000000000), 0x8}, 0x10000, 0xd29, 0x9, 0x0, 0x800, 0x377c, 0x2}, 0x0, 0x5, 0xffffffffffffffff, 0x3) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000100)='qnx6\x00'}, 0x10) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) 03:00:48 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f0000000280)='./file0/file0\x00', &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0)='ncpfs\x00', 0x0, &(0x7f0000000180)="727cd5721d60bef436ef29e3f97b7e43674596321a976ace62414eae47c260614d404860850f8f7ac95d11b38889acc617e5fffb6f7a9b6496faedebcd39ba23a1a68dac5cc03d51157161313972f2a7e65a03cec0a3") 03:00:48 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000]}, r1}, 0x14) 03:00:48 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 147.010220] binder: release 12469:12470 transaction 198 out, still active [ 147.017224] binder: undelivered TRANSACTION_COMPLETE [ 147.029335] binder: 12469:12470 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:48 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xfffffffe, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:48 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0xff, &(0x7f0000000140)="1ae3f319e5ca7c9019717c65f5f866df130a24ce9bf2ed3b0347315caa55b8091ed1002e835a2fd4e10a658434c6e441e19f43cd3b59b7e192c268bf51ab095f18cd1d05e7d36398bff8fad9234cd9dc42bdc580424a459189216e704115d1b5abf11939a19d3e6f729b92476c4e6710024da63abe6b8c651361066aadab33c68dd12527cecc459248d83e61593093042b0f509d432b2ef745a767335614a597519a7721e774167dde6d74bd877fa22d81a527b41548") ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x90001, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000040)={0x0, 0x100000001, 0x400, 0x1b96, 0x7, 0x401}, &(0x7f00000000c0)=0x14) setsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000100)={r4}, 0x8) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) membarrier(0x41, 0x0) 03:00:48 executing program 6: mkdir(&(0x7f0000000080)='./file0\x00', 0x2) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) fchmodat(r0, &(0x7f0000000040)='./file0\x00', 0x40) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000240)={0x0, 0x9d, "40c758d5b4129837cfdf93669a89fea6e24ff19c9048277b7717a59d29658171f46cf16780caa18092f5341e4ce1ecc6664bd3e5a466522cf21d0a4c904819aac8dfd7ceaf8b6b41a89fafa3cae0e42f5432c047e6536c76e320d5e69b04f7a2f189911c9708d39574f7e5d125de79b9a2ddf67eb2dcce4f27abff70fb84a38ad34a5a6eeed2f77fe55609390cfafc2113d629a43709fc8c80aded1564"}, &(0x7f0000000300)=0xa5) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000340)=@assoc_value={r1, 0x7}, 0x8) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) mbind(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, &(0x7f00000006c0)=0x80000001, 0x4, 0x1) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') mount(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)='./file0\x00', &(0x7f0000000580)='cgroup2\x00', 0x2, &(0x7f00000005c0)="2083b0dd3677b99c4d3a05a4b201d148cf463760ebe48bc78aa7e88b28241221347807d9b8a96cd14c72717837052243dfbeacefe7945301fa404358a22a635b1b7dedc30a51eecb8e07804ce9d10fda5283928305446a4d71ac47f3f31af72daca5ea2098da2c62f94757f030a6a97cec02cbfb107def3d2241f6ca086f82e076eacbd79f479970187d13df2eadbfb5e7fcdc5b71e33af7c60f9b3f80e3fc2d8b8151ff76a2fd4ee1543ece2ad622c57a1b2452ba81b3545f1936d7e78b079f7248942971f51f95a7b2") ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r0, 0xc058534b, &(0x7f00000003c0)={0x1, 0x6, 0xffffffff80000001, 0x5, 0xba, 0x1}) recvfrom$unix(r0, &(0x7f0000000100)=""/126, 0x7e, 0x40000063, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) 03:00:48 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}, r1}, 0x14) 03:00:48 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x10000000000, 0x0) faccessat(r0, &(0x7f00000000c0)='./file0/file0\x00', 0x40, 0x200) 03:00:48 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:48 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x2, &(0x7f0000000040)={r3}) 03:00:48 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 147.165997] binder: send failed reply for transaction 198, target dead 03:00:48 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) write(r2, &(0x7f0000000140), 0x28d) 03:00:48 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000040)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x400, 0x40000) ioctl$KVM_SET_VCPU_EVENTS(r0, 0x4040aea0, &(0x7f0000000080)={0x3fd, 0x4, 0x2, 0x0, 0xffff, 0x0, 0x75d, 0x7fffffff, 0x13, 0x0, 0x5, 0x1, 0x0, 0x800, 0x4bf, 0x1, 0x8000, 0x4, 0x7}) socketpair$inet(0x2, 0x5, 0xa762, &(0x7f0000000100)) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:48 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x71da1fcb, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 147.231008] binder: release 12518:12519 transaction 200 out, still active [ 147.238052] binder: undelivered TRANSACTION_COMPLETE [ 147.246311] binder: 12518:12519 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:48 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000080)=0x5) mkdir(&(0x7f0000000080)='./file0\x00', 0x40000000000000) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:48 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000]}, r1}, 0x14) 03:00:48 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:48 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:48 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x8d8000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:48 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$TCSETAW(0xffffffffffffffff, 0x5407, &(0x7f0000000000)={0x4, 0x3, 0x3, 0x8, 0xff, 0x60, 0x100000000, 0x6, 0x9, 0x3}) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x20201) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r1, &(0x7f0000000140), 0x28d) [ 147.339244] binder: send failed reply for transaction 200, target dead [ 147.362474] hrtimer: interrupt took 25999 ns 03:00:48 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x80ffff}) 03:00:48 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:48 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='vfat\x00', 0x0, &(0x7f0000009000)) mkdir(&(0x7f00000000c0)='./file0/file0/file0\x00', 0x40) r0 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0x3, 0x101000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000140)={{0xffffffffffffffff, 0x2, 0x1, 0x2, 0x100000000}}) 03:00:48 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0xffff8000}) 03:00:48 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:48 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x1, 0x0) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000040), &(0x7f00000000c0)=0x4) 03:00:48 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x9d80000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:48 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 147.627249] binder: 12555:12556 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 147.635768] binder: release 12555:12556 transaction 202 out, still active [ 147.642755] binder: undelivered TRANSACTION_COMPLETE 03:00:48 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) socket$inet6(0xa, 0xe, 0x8) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:48 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000]}, r1}, 0x14) 03:00:48 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x80ffff00000000}) 03:00:48 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) 03:00:48 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x9, 0x8000) r0 = socket$nl_route(0x10, 0x3, 0x0) write$binfmt_elf32(r0, &(0x7f00000000c0)={{0x7f, 0x45, 0x4c, 0x46, 0x81, 0x7fffffff, 0x5, 0x3, 0x5dfe, 0x2, 0x6, 0x100, 0x327, 0x38, 0x25c, 0x1, 0x0, 0x20, 0x2, 0xffffffff, 0xfffffffffffffc29, 0x3ff}, [{0x60000000, 0x4, 0x94cc, 0x800, 0x921, 0xeb36, 0x8b7b}], "d253612bc47c779b823d4f9b444c5b0fdadcdb13760e2c39b665559e8835fd7202245c13fa785089519f590d6b6478c1b3fd1223241892843003f00b3ac7ac991a4297b073c5ae972d53febaffb5b7c225c6864a502b0114833826181d4542a54d55b34fc59c63e8231f6168053a2e3bab5c5861f07bc54d1e", [[], [], [], []]}, 0x4d1) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000000040)='./file0/file0\x00', &(0x7f0000008ffb)='fuse.', 0x20004a2, &(0x7f0000009000)) 03:00:48 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x7d8000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:48 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(0xffffffffffffffff, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:48 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 147.724735] binder: send failed reply for transaction 202, target dead 03:00:48 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xc0ed0000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:48 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x14040, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffff9c, 0xc0184900, &(0x7f0000000100)={0x3, 0x20, 0x1, 0xffffffffffffffff}) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f00000001c0)=0x2d, 0x4) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='9p\x00', 0x800000, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@noextend='noextend', 0x2c}, {@version_9p2000='version=9p2000', 0x2c}]}}) mkdir(&(0x7f0000000080)='./file0\x00', 0x40000) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) lsetxattr(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)=@known='security.ima\x00', &(0x7f0000000280)='fuse.', 0x5, 0x2) 03:00:48 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:48 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0xffff8000}) [ 147.890645] 9pnet: Insufficient options for proto=fd 03:00:49 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:49 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xfffffffd, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:49 executing program 0: mkdir(&(0x7f0000000300)='./file1\x00', 0x0) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$adsp(&(0x7f0000000200)='/dev/adsp#\x00', 0x5, 0x0) mknod$loop(&(0x7f00000001c0)='./file0/file0\x00', 0x10, 0x1) mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil) r3 = accept(r1, &(0x7f00000000c0)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000140)=0x80) write$tun(r2, &(0x7f00000005c0)=ANY=[@ANYRES16=r4], 0x1) r5 = accept4(r0, &(0x7f0000000380)=@can, &(0x7f0000000080)=0x80, 0x80000) socketpair$inet_sctp(0x2, 0x5, 0x84, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(r5, 0x111, 0x4, 0x0, 0x4) finit_module(r7, &(0x7f0000000040)='/dev/adsp#\x00', 0x1) write$cgroup_subtree(r2, &(0x7f0000001800)={[{0x2d, 'cpu', 0x20}, {0x2d, 'memory', 0x20}, {0x2f, 'io', 0x20}, {0x2d, 'rdma', 0x20}, {0x2f, 'memory', 0x20}, {0x2f, 'io', 0x20}]}, 0x23) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000000000)='fuse.', 0x0, &(0x7f0000009000)) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000280)=0x0) ioprio_set$pid(0xfffffffffffffffc, r8, 0x4) r9 = shmget$private(0x0, 0x2000, 0x78001504, &(0x7f0000ffc000/0x2000)=nil) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f00000029c0)={r6}) recvmmsg(r3, &(0x7f0000002940)=[{{&(0x7f0000000740)=@l2, 0x80, &(0x7f00000028c0)=[{&(0x7f00000007c0)=""/4096, 0x1000}, {&(0x7f00000017c0)=""/14, 0xe}, {&(0x7f0000001800)}, {&(0x7f0000001840)=""/4096, 0x1000}, {&(0x7f0000002840)=""/115, 0x73}], 0x5, 0x0, 0x0, 0x1}, 0x747}], 0x1, 0x2101, &(0x7f0000002980)={0x0, 0x1c9c380}) getresuid(&(0x7f0000000240)=0x0, &(0x7f00000002c0), &(0x7f0000000340)) fstat(r2, &(0x7f0000002a00)) getgroups(0x0, &(0x7f0000000440)) getsockopt$inet6_IPV6_IPSEC_POLICY(r5, 0x29, 0x22, &(0x7f0000000480)={{{@in6=@remote, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@rand_addr}}, &(0x7f0000000580)=0xe8) getresgid(&(0x7f0000000600)=0x0, &(0x7f0000000640), &(0x7f0000000680)) shmctl$IPC_SET(r9, 0x1, &(0x7f00000006c0)={{0x5, r10, 0x0, r11, r12, 0x8, 0x6f}, 0x1, 0x2, 0x8, 0x0, r8, r8, 0x48000000000000}) [ 147.972530] IPVS: ftp: loaded support on port[0] = 21 03:00:49 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x80ffff00000000}) [ 148.035931] binder: release 12603:12605 transaction 204 out, still active [ 148.042938] binder: unexpected work type, 4, not freed [ 148.048238] binder: undelivered TRANSACTION_COMPLETE [ 148.090763] binder: send failed reply for transaction 204, target dead [ 148.525158] device bridge_slave_1 left promiscuous mode [ 148.530677] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.541424] device bridge_slave_0 left promiscuous mode [ 148.546866] bridge0: port 1(bridge_slave_0) entered disabled state [ 149.179875] team0 (unregistering): Port device team_slave_1 removed [ 149.188722] team0 (unregistering): Port device team_slave_0 removed [ 149.197099] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 149.214747] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 149.233845] bond0 (unregistering): Released all slaves [ 149.442851] bridge0: port 1(bridge_slave_0) entered blocking state [ 149.449247] bridge0: port 1(bridge_slave_0) entered disabled state [ 149.456322] device bridge_slave_0 entered promiscuous mode [ 149.485183] bridge0: port 2(bridge_slave_1) entered blocking state [ 149.491579] bridge0: port 2(bridge_slave_1) entered disabled state [ 149.498657] device bridge_slave_1 entered promiscuous mode [ 149.527129] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 149.556743] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 149.630479] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 149.657903] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 149.761608] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 149.768653] team0: Port device team_slave_0 added [ 149.787702] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 149.794709] team0: Port device team_slave_1 added [ 149.813883] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 149.835536] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 149.856997] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 149.877825] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 150.038821] bridge0: port 2(bridge_slave_1) entered blocking state [ 150.045178] bridge0: port 2(bridge_slave_1) entered forwarding state [ 150.051763] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.058096] bridge0: port 1(bridge_slave_0) entered forwarding state [ 150.652568] 8021q: adding VLAN 0 to HW filter on device bond0 [ 150.712110] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 150.771618] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 150.777766] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 150.785058] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 150.842205] 8021q: adding VLAN 0 to HW filter on device team0 03:00:52 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:52 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xd7ff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:52 executing program 6: mkdir(&(0x7f0000000040)='./file0\x00', 0x1) syz_mount_image$jfs(&(0x7f0000000000)='jfs\x00', &(0x7f0000000080)='./file0\x00', 0x6, 0x5, &(0x7f0000000600)=[{&(0x7f00000001c0)="348d25751cac19ce94bf27abc28b9cdc2e4c31e3a6f62f0f293b923ba0ba439a60b729495c723de57bb03eab7cffff85436e72a22b97fc8c2664c9fc097cf4cedb29e1c743c68a3f7c8d9e48349afa4fa826fdcd74904bb9859256b4ef790a6411f1d4a75898062a93ed7b21b03bfc2b88af99d765d80380b35fb689a323e61f6708893afad9783081da8a134885444546dbde2937666191c32bdc56584ee0cb3b09ad454acd7a4ef342b03faebfbe442049d9db08117680ac995a3eb206669e", 0xc0, 0xffffffffffffffff}, {&(0x7f00000002c0)="1267a903ff05e0848ec6da9377fb6a0fd98ed2887f9e4c1e4fc9ecf81e8b1009eec40e0ea53beffd7ecf7814c5d0836c9b71e264ebcfe41df5015841feb2313cecc44a0b4b4234f25f52b79269e06a1ec51687b241a3ef3841c74fe40b0f08f076661a6b39e41da746665cc7a7389a957fdb46b9ae2d5d76e9511b0eb93b9caf7a9f069276bbbf63f0ab369bc5013a8c99dabc0e814462257ba0a89d9fcac271a0f754bd2dd7b5f3268963ac555bacf71f616bd4062850ae45bfb1218ef6fb7f", 0xc0, 0x6e10}, {&(0x7f0000000100)="8bc07c7adfe717fcd18f3eb78df55e48172e5a9ec747bcdd7b8fd5b3cf496d06dca0336cf856aaf03866bd9234379acc96c7d89701d66fba939864cb1511e603d8c215de2b76d57e691a7694bbd5f88f42edd5d0a2bb03fd602ae035c735abee0c0e47b476d7f1f9b761ef729c43514aa47243ccd43b978e9343a131", 0x7c, 0xcc50}, {&(0x7f0000000380)="413cc27fa3008ac36c07e52735ee111065257113dd2b7ab14b813c6d23c88b5c864e06331757a43f307297d84a1994c820419bb242b0a4710c20fede736720dfae9c1938ed16987f987dd0acb7721a0921580267d00de03e54c7d28b4496fad19bdb8a8f5de81a4f53ddb3ad09c8989273d0a016510628d5f1b331544d25f387a51a36dd2287c741683c5e520442041e64a5", 0x92, 0x296b}, {&(0x7f0000000500)="a2eae980cd4e33307e4ebe345a5eda83f9cb7323ea976b5916f98f5fbf49656d2db09b818ace701c3c87b13478ee8c13bdef575cf7af087d62fcd8011cd46d6c253b31337f2fdab7822e159370b59b5158142fc4cb34a9f60faf30e0639a23807a554355e730e9d1f5a79788e4d6964c83fe329cf9eb40c28484841889469b5d239ffeeb9f37aef0b12a4aca7a38795af834d17921955cac6f0755230ea9865da9cd862f3a03a5878227ce99736461fd91a4a40ca4f9a8647b2208f8d14f10398c2290e01fa80b440bc0452206a3acdd9b4c867138b546c3737a8f60b5afa55ae6a35e17", 0xe4, 0x5}], 0x40000, &(0x7f0000000680)={[{@nodiscard='nodiscard', 0x2c}]}) chroot(&(0x7f0000000740)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000700)='./file0\x00') 03:00:52 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) socketpair$inet(0x2, 0x80007, 0x1, &(0x7f0000000000)={0xffffffffffffffff}) accept(r0, &(0x7f00000000c0)=@sco, &(0x7f0000000040)=0x80) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:52 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = semget$private(0x0, 0x3, 0x10) semctl$GETZCNT(r1, 0x3, 0xf, &(0x7f00000000c0)=""/149) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00005befdc)) r3 = syz_open_pts(r2, 0x2020201) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x20) ioctl$TUNDETACHFILTER(r4, 0x401054d6, 0x0) ioctl$RTC_PIE_ON(r4, 0x7005) write(r3, &(0x7f0000000140), 0x28d) 03:00:52 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000]}, r1}, 0x14) 03:00:52 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x80ffff}) 03:00:52 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(0xffffffffffffffff, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:52 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}, r1}, 0x14) 03:00:52 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(0xffffffffffffffff, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) [ 151.220597] binder: release 12926:12929 transaction 208 out, still active [ 151.227613] binder: unexpected work type, 4, not freed [ 151.232907] binder: undelivered TRANSACTION_COMPLETE 03:00:52 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:52 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) socket$inet6(0xa, 0x4, 0x8) 03:00:52 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000000040)='./file0/file0\x00', &(0x7f0000008ffb), 0x0, &(0x7f0000009000)) [ 151.276606] binder: send failed reply for transaction 208, target dead 03:00:52 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) munmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') r0 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0x208, 0x800) write$sndseq(r0, &(0x7f0000000040)=[{0x7, 0x0, 0x1, 0x12000000000, @time, {0x5, 0x1}, {0x800000000, 0x6c}, @queue={0x9, {0x7fffffff, 0x1ff}}}, {0x401, 0x3, 0x8, 0x0, @time={0x77359400}, {0x9, 0x1}, {0x401, 0x32}, @queue={0x40, {0x49a4ee80, 0x80000001}}}], 0x60) 03:00:52 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0xffff8000]}) 03:00:52 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000]}, r1}, 0x14) 03:00:52 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xb402000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 151.345676] binder: release 12962:12963 transaction 212 out, still active [ 151.352814] binder: unexpected work type, 4, not freed [ 151.358106] binder: undelivered TRANSACTION_COMPLETE 03:00:52 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:52 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:52 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x108) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:52 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000]}, r1}, 0x14) [ 151.452440] binder: send failed reply for transaction 212, target dead 03:00:52 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:52 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x80ffff00000000]}) 03:00:52 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e24, @multicast1=0xe0000001}}, [0xb, 0x7, 0xfffffffffffffdb1, 0x0, 0x40, 0x0, 0x1, 0x4, 0x0, 0xfffffffffffffc00, 0x7, 0x3f, 0xf7, 0x6, 0x855a]}, &(0x7f0000000040)=0x100) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f00000001c0)={r1, 0x101}, &(0x7f0000000240)=0x8) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000002c0)) r3 = syz_open_pts(r2, 0x20204) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r3, &(0x7f0000000140), 0x28d) ioctl$VT_RESIZE(r3, 0x5609, &(0x7f0000000000)={0x101, 0x3}) [ 151.496189] binder: release 12990:12992 transaction 216 out, still active [ 151.503188] binder: unexpected work type, 4, not freed [ 151.508483] binder: undelivered TRANSACTION_COMPLETE 03:00:52 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x42800, 0x0) r1 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x0, 0x2000) renameat2(r0, &(0x7f0000000040)='./file0/file0\x00', r1, &(0x7f0000000100)='./file0\x00', 0x2) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:52 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:52 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00]}, r1}, 0x14) 03:00:52 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:52 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000000)={0x4359143e, 0x1ff, 0xfffffffffffffff7, 0x4, 0x7, 0x3, 0x4a7, 0x80, 0x3f, 0x80, 0x1ff, 0x100000001}) write(r2, &(0x7f0000000140), 0x28d) 03:00:52 executing program 6: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') r0 = socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r0, 0x800448d2, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{}]}) 03:00:52 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x40000, 0x0) getpeername$inet6(r0, &(0x7f0000000040), &(0x7f00000000c0)=0x1c) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) [ 151.605510] binder: BINDER_SET_CONTEXT_MGR already set [ 151.622517] binder: send failed reply for transaction 216, target dead [ 151.635467] binder: 13017:13020 ioctl 40046207 0 returned -16 03:00:52 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xb402, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:52 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0xe0}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:52 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80]}, r1}, 0x14) 03:00:52 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x80ffff]}) 03:00:52 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/llc\x00') syz_extract_tcp_res(&(0x7f0000000040)={0x41424344}, 0x8, 0x6) syz_extract_tcp_res$synack(&(0x7f00000000c0)={0x41424344, 0x41424344}, 0x1, 0x0) ioctl$KVM_GET_TSC_KHZ(r0, 0xaea3) write$tun(r0, &(0x7f0000000100)={@val={0x0, 0x201}, @val={0x1, 0x7, 0x28de, 0x6, 0x1, 0xe0000000000000}, @ipv6={0xffffffff, 0x6, "3e6292", 0x192, 0x5e, 0x3, @remote={0xfe, 0x80, [], 0xbb}, @empty, {[@srh={0x0, 0x8, 0x4, 0x4, 0xb4a1, 0x78, 0x8001, [@ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, @mcast1={0xff, 0x1, [], 0x1}, @local={0xfe, 0x80, [], 0xaa}, @dev={0xfe, 0x80, [], 0xf}]}, @fragment={0x0, 0x0, 0x3, 0x2, 0x0, 0x8, 0x64}, @routing={0x3f, 0xa, 0x1, 0x9a0b, 0x0, [@mcast2={0xff, 0x2, [], 0x1}, @dev={0xfe, 0x80, [], 0xa}, @loopback={0x0, 0x1}, @ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, @local={0xfe, 0x80, [], 0xaa}]}], @tcp={{0x4e22, 0x4e24, r1, r2, 0x1, 0x0, 0xb, 0x50, 0xffffffffffffffff, 0x0, 0x6, {[@fastopen={0x22, 0xd, "205faf324b390b11331a54"}, @sack={0x5, 0xa, [0x7ff, 0x1]}]}}, {"80bc1da9013a5905e89a397c99c175d658da3e0a50527696e4f2d5f620564d35d0c0a7f8d50d94bf1604420725941f5c60945fdeaac5bfffa2243f9235649ed9705053477794328ba5f8af02eb8b17072a08106cd4ec7c8e77c9d69ef3ba085c294149fd4d831aa490ffe4fed696a61d5253117f9654d9f532675b8f95b76a588cef74668ddae45c778e305492d15f781a1135abb3d218660354d262bc15c4587b7b7440d4b853f7e065cec736a8de0c4b64d9580f7f598ce3be3ba562bd"}}}}}, 0x1c8) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) [ 151.704717] binder: 13017:13020 transaction failed 29189/-22, size 24-8 line 2852 03:00:52 executing program 3: r0 = socket$inet6(0xa, 0x1000000200002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000000)={0xff}, 0x1) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) 03:00:52 executing program 6: mkdir(&(0x7f0000000100)='./file0\x00', 0x2) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x5, 0x101040) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0xc0045540, &(0x7f0000000040)=0x5) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@rand_addr=0x6, @local={0xac, 0x14, 0x14, 0xaa}, 0x1}, 0x10) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') [ 151.781146] binder: 13017:13020 IncRefs 0 refcount change on invalid ref 1 ret -22 03:00:52 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x200005ee, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:52 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xe00000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:52 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe]}, r1}, 0x14) 03:00:53 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:53 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600)={0x0}, &(0x7f0000000640)=0xc) ptrace$getsig(0x4202, r0, 0x0, &(0x7f0000000680)) r1 = open$dir(&(0x7f0000000140)='./file0\x00', 0x50002, 0x80000000080) r2 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x8000, 0x440000) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000180)='westwood\x00', 0x9) ioctl$TCFLSH(r2, 0x540b, 0x0) renameat(r1, &(0x7f0000000040)='./file0\x00', r2, &(0x7f0000000100)='./file0\x00') setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000740)=ANY=[@ANYBLOB="72723ae97a854d32000000000000000000000000000000000000000900000003faffff1704000048010000ffffffffffffffff00000000ffffffff80030000fffffff2023ee4797748989cab88d6ba6eaf60f3c554301c7dd8c9bd80c78e3efedec5ff5dc5b1b70feba55957868cfa21c561b6221fe4df641786ede15772062d9295d67b13e16723c71e540f5e4718460cc5a9646d0e14828bccef1d9bdeded77512ef28d58b07a312d2c5c6f07e44fa938b7d7bca8d4a9ca1f3003ac2aae714638409f63d314b5fb2dbeaceb215296eb7e1e1a078f1192702f635a8218911a641426db45a17490de261bd48062b7700000000000000000000000000000800000000000000a086d4657bb07c1d5edb477f53931e3b414a9d3cdc2874207d8a42416b143f917cd3d7f473d04b6eeb25d42ba34a005c4ebd9f8f2d0600000000000000b10c629eb6152966497faad94f2bd73157a1094dbf866f6f000000000000000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e80048010000000000000000000000000000000000000000000000002800727066696c7465720000000000000000000000000000000000000000000002000000000000002800727066696c7465720000000000000000000000000000000000000000000004000000000000006000434c5553544552495000000000000000000000000000000000000000000000000000aaaaaaaaaabb500e0e00120002001700300017000f001300100023003e0033002e00380018000d00100000000300000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180238020000000000000000000000000000000000000000000000005801686173686c696d6974000000000000000000000000000000000000000003626f6e645f736c6176655f3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000a0000000000000005000000f7ffffff0400000000000000007800000000000008000000000000002800727066696c7465720000000000000000000000000000000000000000000002000000000000002000545241434500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000"], 0x478) r3 = add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000200)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000240)="37bac35796042306410e132c1f18c744e3b5e815f96667ac79a67d20bbfa3353c2cf9377cade261d3cbce2231327909d9672fcb5eddc0ce43ef02fa4228f0df621ba7de0dbacd183ea81a3e208f7b4761abc8422a833137a830a74022fad26c6e6c5f95fb5042b74d25ec4aeaa2aa3764777dbac9590f98b9be683636cfeb9dc01686b76db61f1d2ecc76cc7747273cd118f93c49276b9747e5e16681182e96ba280f1d5847ac68fa5a7013eb264331efae74f77d539356dc261f5da080dd83a2e3fd3", 0xc3, 0xffffffffffffffff) ioctl$SNDRV_CTL_IOCTL_PVERSION(r2, 0x80045500, &(0x7f0000000380)) keyctl$read(0xb, r3, &(0x7f0000000340)=""/45, 0x2d) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:53 executing program 3: r0 = socket$inet6(0xa, 0x1000000000082, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) [ 151.854408] binder: undelivered TRANSACTION_ERROR: 29189 [ 151.876152] device bridge_slave_1 left promiscuous mode [ 151.881826] bridge0: port 2(bridge_slave_1) entered disabled state 03:00:53 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x80ffff]}) 03:00:53 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x5000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:53 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0xf, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:53 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0xffff8000]}) [ 151.968710] device bridge_slave_0 left promiscuous mode [ 151.974256] bridge0: port 1(bridge_slave_0) entered disabled state 03:00:53 executing program 0: openat$uinput(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/uinput\x00', 0x1, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) syz_mount_image$gfs2(&(0x7f0000000000)='gfs2\x00', &(0x7f0000000040)='./file0/file0\x00', 0x7ff, 0x6, &(0x7f0000000240)=[{&(0x7f00000000c0)="2b26d9d7", 0x4}, {&(0x7f0000000100)="5785b7008a17c9709e50af568c4b6df40c3ced58447d7a46a568b1ed8bfc95ecb4feef6949ac2448cc6e02dabedab3a7", 0x30, 0x401}, {&(0x7f0000000140)="bae597b1ccd93c6e3583c9a8cd77949fb118fec9", 0x14, 0x4f}, {&(0x7f0000000180), 0x0, 0x2}, {&(0x7f00000001c0)="555cbfb221e37213562eeaac09873ce0ad0366a2c79ef7fed5014ccb4e19c62187a447c967b07dc89cf6f90adc7e60162af1d60347db6d3b5e747c9400af", 0x3e, 0x200}, {&(0x7f0000000200)="3fa12283108055d48b5a95bf3b04e486351b4e992907837e8c799aac8d24009bf421577d5b113fb4fa4167a30af37477b85f9ed2", 0x34, 0x8}], 0x800000, &(0x7f0000000500)) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x200000, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000300)=0xacd) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') syz_genetlink_get_family_id$fou(&(0x7f0000000580)='fou\x00') sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0xc01000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x78, r1, 0x100, 0x70bd2d, 0x25dfdbfd, {0x8}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x8001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local={0xac, 0x14, 0x14, 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x200}]}, 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x40000) ioctl$sock_bt_bnep_BNEPCONNDEL(r0, 0x400442c9, &(0x7f0000000540)={0x5ac, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}) 03:00:53 executing program 3: ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x20201) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r1, &(0x7f0000000140), 0x28d) 03:00:53 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:53 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x9b7c4bef, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 152.084308] attempt to access beyond end of device [ 152.089346] loop0: rw=4096, want=136, limit=4 [ 152.093878] gfs2: error 10 reading superblock [ 152.098161] IPVS: ftp: loaded support on port[0] = 21 03:00:53 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x80ffff00000000]}) [ 152.137353] team0 (unregistering): Port device team_slave_1 removed [ 152.170614] team0 (unregistering): Port device team_slave_0 removed [ 152.196840] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 152.234511] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 152.272139] bond0 (unregistering): Released all slaves [ 152.289760] binder: release 13081:13082 transaction 221 out, still active [ 152.296765] binder: unexpected work type, 4, not freed [ 152.302067] binder: undelivered TRANSACTION_COMPLETE [ 152.318735] binder: send failed reply for transaction 221, target dead [ 152.708067] bridge0: port 1(bridge_slave_0) entered blocking state [ 152.714461] bridge0: port 1(bridge_slave_0) entered disabled state [ 152.721854] device bridge_slave_0 entered promiscuous mode [ 152.745779] bridge0: port 2(bridge_slave_1) entered blocking state [ 152.752157] bridge0: port 2(bridge_slave_1) entered disabled state [ 152.761149] device bridge_slave_1 entered promiscuous mode [ 152.782376] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 152.803496] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 152.856632] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 152.879417] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 152.959075] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 152.966142] team0: Port device team_slave_0 added [ 152.984869] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 152.991903] team0: Port device team_slave_1 added [ 153.010818] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 153.032979] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 153.053077] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 153.060471] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 153.068286] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 153.084090] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 153.091207] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 153.099009] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 153.260175] bridge0: port 2(bridge_slave_1) entered blocking state [ 153.266548] bridge0: port 2(bridge_slave_1) entered forwarding state [ 153.273137] bridge0: port 1(bridge_slave_0) entered blocking state [ 153.279486] bridge0: port 1(bridge_slave_0) entered forwarding state [ 153.286558] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 153.759244] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 153.886076] 8021q: adding VLAN 0 to HW filter on device bond0 [ 153.946804] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 154.007338] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 154.013470] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 154.020940] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 154.077145] 8021q: adding VLAN 0 to HW filter on device team0 03:00:55 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x6d80000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:55 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:55 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) r0 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xb755, 0x40441) ioctl$RTC_IRQP_SET(r0, 0x4008700c, 0x1a78) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:55 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) mount(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0/file0\x00', &(0x7f00000000c0)='9p\x00', 0x200001, 0x0) 03:00:55 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0xffff8000]}) 03:00:55 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0) syz_mount_image$ceph(&(0x7f0000000040)='ceph\x00', &(0x7f00000000c0)='./file0\x00', 0x5, 0x6, &(0x7f0000001640)=[{&(0x7f00000001c0)="6efd598c52ade61819438c3cfd0328c3dd695018ec35d17d98dfb9c7dd97919c6bef931d6e8a1100ef5d", 0x2a, 0x7ff}, {&(0x7f00000003c0)="152b67abe066ff7012470251cb2f37e1cb1c63db603c9b3f85d7df9c435533d389286e5634da0f0760ff2cab60da383804164373717faedf0af5147acccd94a3ef351c8d6ff943f0e6c8b7b117d9e2689017bd7577e23302b227ce04492c835058479825a9d8ec280696fb1dd8e0a7d04e79aba24e2bdc9ec27065ac6391d3f4acda218218d61872ca837ab26e54d70e373ada9131b172e44fd06fee0a98a5d2cb531cfc493bece617973d535c93b50bf7fc6de819529379", 0xb8, 0x7ff}, {&(0x7f0000000480)="58ddaa0a671cbf0b8ad73ebfd307a964dd2355f3e3019cace322803909edbf067f64f8823d2b84db07ea0966abae29e81a18f68eee69ac701b34676b3fc7aa81e437c0d1a8b3dc740d3405ac14673a30ab0e5ca6b4650f966e6da3fce9395588d4a8eb9f60630d35058406c5dda3a0e28a298bb82862b4b180762a400f29a1110a27a04c", 0x84, 0x8}, {&(0x7f0000000240)="d2ac95f7df853272a5e31baf4d21e6db2808c961728448f093fb781f", 0x1c, 0x5da0219c}, {&(0x7f0000000540)="5a1f3038d8055d1bf92fbfd1e6fe13df15c13c89bcaf0dc97fbbd11a495121e622894c84ac940bcb1ff5dadd6068c6896061b5a3db45d472dbd8eb1b78999653324fa3bc60dcd7c498d25c4cc9521b160c457689fdfeea706f84a2ef08974a05d4b5a55cc1cafe17528790c74cc46c7d1abb937cdef2afc688c57c87a538bc4323479c3ebf269e9e98f9e60fe409b54d26f75a285636de041de151e78a96db5c683846e3a4b2119f3e3422980cde578af5c36e6cbed44a78b16eb7d3265737ae152756d1b779a7997203872f89ba0cf1fa775f5d36c0416e785e0ebbdd7b19352e79b2b14dc297ce553c6667dc7cb0f4b0991e85491b1f5f69e82cf33700423da1acccf438145f720d0b80313923bdd337c8766512e80dbd1b25db20ab1e3618f65934ad086b8e17be94369ee8ddf5111b3e17bc7eef85f193d7a7f2b642d157a11dd62d850f48879aaadd3447fbeaee9bcb754c954c04de5a93ef352d70236a8fb8e7c5b5da9dade0d4310681db8cf7e0f638bd33da3dc89bcc39ff1b24d3a4b7f44dc42d51d6fe97f8b4871f4b0a88964044e67aab0db635d54c42a39a15ac4a93df737aeaafc2e833e9c007f61a34391343ad0064bd9c767df4f6a0b64334ae4bb7526e5a802e9b31a7c1c1e55db6130da993fd3c55ae847b6933ddb2a32709f1064ec7e2315ca2dfc94d8287fcfe6cee4a5a652936a4025ae97bcf17ac5c020d40d2eb59b28ecd0de4152d8d8817e58c4b2c57454965f614d15dd5d90548fdc2819ec7c6998d344566eb4a4d2f414096a507e7f8cbf1349040cb96c7632783c022336bcb116cccbcdf715328c7194834184f4d7245746b888ecd1e910a440ecc044d52f367fd0e1a65d5334150392ccb41a474c2a31c68b2ef7a58a2c1af802d7be5523ea65cbe75a99a67e2ad33056d98280a02c3b2d782132c20b59f3dd839fda4c25170a68892211595bfb022f2c01ddd72655a1e478b22f15751fcefeade700578ff7b0f23074441ba0d345ef041c795441d2108f317b94df97e2981fdb04c69ba9cdbeda76a8b4e3d9300c91f641a5c84a6e74e3df3c653e45ee36536b3d2ee0c77c875d925f3f55a27a2a21f717afea636d163fc84e00b6d643c9d3e3b5e03a6fedfbb687e435b18e2ca00bf5c20b75f093411eb4201436664825ebbf248f2c97ec6202e9af81d4846bc14c1a1466c4f8a2b7b54f8af1771966568c614295063ace45380ebbac8f0dc65410d843116355fb18323e93a11f46a5a47926179490f03da62b09f51d7584db3ddee97eaf9d5d8303934666760dc383a4e51dc9a1e3852895e5cb5b65a280aa43b084d8692f0c730ca3978c74f86b92940dad986d2b70f123bf37892a4cde348dde5239ca3dfb5c717db5d0660658db1eb533d06f5e61a1cb900a79ed8990307bfc14197c615c75211c2f4ad2ee952404a5dfed894463468d08227b3cd49ff921d787a61d253c9143ef2cd1b94ac9e5c51edd7c4e85926646c94a446a2f1cb1b4fabe8cf5b40fbad6337d2b2200ebb09d4f2c6abe89a9066d7f0b59084ca6362ef4c054cae1cff23c97b1716c735f5a2bf21017432c50119f888390edda4f9ad4bf511418096ad11da6752488fa1f62562048e22f9ddceede6c889d4855e24ab9ade38686141daf40ef2f16ae79fbb74379e10cb55c5e744fcf513d7bb88a3528283692be7907dc7f4e7eb82d5ec334fb3070d9bd98658c43ee59f4efb91d7f2560c1b7efb955b2b7bede2f3ea468f93c80b6008efe28612868d85f76e4312c0b759eb6610f7aacdf43b14d4bf8e3841dff9bfe55918856edba4e40a43ed9974320b7adc4af9a052af5ba5190a1f45ee7dfce87fdad2ced93745360ed5a1e0fc4c92b56d08067b2f57844df23f201a4c1900f75189f71be954cec221efb30e8528380c22308e81dfa4cab70875e2aec899a31ff45926e475fcee6f0d70eed898c2319c001a689664157d69447b41e097eb875315e87f76687a59aaad60716cf6e5bf2546820212e0d828cacd3ae9e182668d262a32e008fb23a9ea0fb32d5ccf36d9e57c1ae0f16299f4a52a4952ee0c1897acba8e9474d047e0a1b373b251745c373823d13838dbe82820b04265eb1f85b786658dfe70bddc1a3eba4b37fa6c8160f55addc712c046edf5e5d3a67d611193f4099e6381092aa9f26ffdca33734a2d8051d6204850a8546c3391fc16da4f0b924d94590cdb4628ed49e7ee6722d4a0998c5f8f9ae6b5954c97746352cc4f8a99ab5423223430ff23268b4327d90e5b97bd66504a2cab487cf00a41f359e22710a06964f75261cb7d85517475cc411305f247233a2367ca0903b90e4a298699f5855a40cc03f9bac30b35465c2f42d456ae55e42cd9a04c0bcbbb1c7b40e9ab6b0de11269e9d18db94e989e4cd1cf6cdad5473203d1773abfb244a9cf1cf1374d17411bf9eaebd30382ce43003a012ad82d503ba54f389928315569d8b479eb5a32019f261ea472fca50e671186fdbd20e7a768f37eb0ce85255a06ac320b912b4b1fc50b0eb55ac5b06e77f900e47bbfdc991c2a76f0152cc85b3019e67b57c859d82ee5863547a267c568ef6de76a8a8de2ef8587c9291bd88f7681302d35a9886fe5a120733a8cbada86240a253bf0a9a2fff1167044d4e2b5c48407d3cd40f1d6ebbf26d18f52bfdea4b625655c035b9a0ab6a7ae06e588a49763f2c82992dfc416fc72689ed9dfa49a0b97bc3b07fe8bd670248747ac032c509375303a25dfa671cd81a8636dfa7ecaa1a379f5ce9b9c63f10db388962e304766e574ee6133fb2ba700c0e64730a01d41914d8d38677fd87f0f6855177ec4aedaecc1553fc0acc7a41fa8e24789a2c160bd739e32dd35137ffe476e3f378ff0e9781324e852c8af6416289bdd3953b6d6e20cf00d462b1128a4035b850e035d84129790364e700eed715691c89f7aada5751eb37a99921009ceaf55f7e5ccb08774246dcf178b53ac62a208e3660f8ae30391238f864f81a5e80e6820606058e7369d19458f0d24081bc062b3d2ace838ce34541f17121e3c677a3dc3e3bcf57f0531f7aa97b4a6e5fdcf9c4fcc770cba379362b6f16f5efcb107b5354d43f7665b2155e65b22ad0ba024ab6d38465429a2d1c8f88b30f19e78ca2554783c722483cb899637ff93b553d9310ee7a2a613a7f87ae0a956364f0ecbcae9013feb46c72b431393a84cdb79c92c614dc521de1dc0180495a4d9a1456cb3ad03a51e014969deac13ef9efd508c00bcd8d5dbc1b8e4edf92f84cc81db51e84d22e223d2c71a59074f6125fb137806de53510397863d70be878a165d250b7fc31e0952611f6178e67b39b82eae40abfb064cdd368531455576807fd15c30282e3e6dbbbcee94bc6eaf4c5b905b42d3198ed75a59ccb25cf5dfab379bf930ec2a0f02c6ceb326fdaef846f8a571ae1ca4884cab62666fbb848d873a2eaf26eb74df42f93ce76d3cea25d6107f70ec936f10d467018c9611ff895a14c47be4f88d22fccb5bfd7011bace77ef176f081ce4321cf39889e0cfe43141b63a6359bebab37f0699dcd18b59a5bf53a8b7ada4a98e9c4a82030332429e69187062c0762f8d9d58970f58e5f7ab06725b49a8daae2ccd46c27b3f377a4876e1acb1d9232fed1f3cc036a74620f55b2ccd41c29918ee3f23b4205552c18727e13563688f85a3022cef58db7c316b4e2f360508530865df6910d5be93551b8fb9b7761c80e38af636554aa919981e26e596faf80e6181f5439ec9dea2039ac0740094b6c7e21dec5c6df15de8aa66ed99a9f28bf98ca5bca83cec67a196400850c654c7a5027139d42087d33fd310e0339cd0b70a51836925fccd0afdc33aa77bf98dd90df3d069bc9d9ea6dca00cae622f84dd97cb3a0b359a90518f29ccedb35791accb00a0279bf8ca818a6699d827b309ffa88b31bf393e2c3e887cc803bc05af6de3f2ec8502a5a358e98e654c74b9950e2dae76e2c7fb68d85071289ca4ea256ffc52eb9ef2c98d04d66f79db2b3485e2e80bd29332e4b9b088ef772caa3a980bab9a57d986ebe06368e56ad3025aff90c9dd4ac4e149b071df12d644ef74a2b9b556ad84e1b379b46aa645b98c0a4476d958b965b7ee3a37a3481deaa7c0e7e2453043a4c70bb822e6f164c0bc87789a951b342083e2aa611b6f347c4abfb5714e1795f71ec79d654d1dd0f937fe0700c2ab4f4f705951cc29b65490b190cdf9e648be3f2614918a79ac0f9537d73b61f39ccb2ac2884ffb9cbb4c44495c5f7007a6ce00d9e8c08dff886fc4922505ae50544d4c890168860617eed306d7daf57388ce2afc21ab6928ad53d9832df143dcf3c654878f3cb55773e87910ef9d8e9b50ab423ec56b7a921fe918b313f241532f6ede377caa5ce907b130168e8e449c9b8ad82d0eb6440a2daecad462e83db53a36a25c89ee13a6074f8344651a75bf577ba35bf0a196688a18489f391d7c68e224f4465cf3b02eb31c27653de367a6c777f626ed96805898a449b7e98280fa336f6759e8610be46d1945f520f00820381e6010dcbd269386bd63b250c7087ab3f6ff07f48530bb68ac89b1ad1a87e44ca285a5ba026b6547dc3926ac88db5a673d02ddeff2338d136d8395cb8e034410882797b3e537a602a9e6ee3ce759fdac63763cc65061244091bf8be7ecabb0c18d226c11d5a85a17f72170d78fe446f7f1f427ca2ca82c6254cfd31006fe37ac5d82f12635195664214ba895cd3559d65be0dcce17fba35f0c9c6f45bfbe42f4560ad701fd34c383dfd9e4208e37cfcd5bc316594d3ec1d3316bcf84cfcb2fa2c0394800e1d8a10b53c33cda7348243639439ec3c9f2079127bd32c5a81acf538016bed361c91fa88f485ceb20cb72785aaadadf9e1e70d0c44e844ff42e1b520df5533a4ccaf14e411ba0f4b0b9e66bfdffaac04d9d3969cbacd8550a7d5f2838d8b380a8f0d701223993f624f4e09db25974dff2a5b4823184fa0d8ece0b9e0c050d9512d925f2d3290b0d66231e78300b0a421501a7db7ff4a5a3ae357092a4823eda2c9d7ef43ac9bd92e7af57ff10fd7bbddeff5eaea7a9b23dd0752c05361808b855a5553cf88ca60e72f99a03d61f0b4121d1d4a2a86ba70806d5dc27d735c99d5b168313249ec274f310129040e00b4087044bb157e5b0be1502bf9ef858e5c1c376ec14adb498c1c8abbff5f647c984b5394c8a8464b3da680f99d07877090a3e5b11f0a9dad02507fb493d32b893682f4bd0d0d8a5d6ea30bc67fc5188b99024a94c1e9a99b06c8ca96952f46a7e414df2d140d18681bb6a7011610f58f04c57b62751b26be5f5d1735f831c7e34a631d6a3f3288876775dcabb5893d8470a604b3e58cbe96d7d8e89027a0665ed6fa1f6473e38c84afb15865c3cd941e7c768a888653e31456cac28e96792ac76c40ae8062b7eeb77d819cbfbf984b5b87e2943463ae8cd553b182bdc69081307faebe3b9c2bf8d573412b609232b6ed3f079c7d47e8897a88e610382409d13fc19fe805714d2af85ae20a4d29fb2adf2e1e8e11b43d3c7bd3fa25bf9b1921f22116aefd941e380c59fc000571c78e86dfe9d0b9d6ed62df9800fc1e5f4b155462005e1ba1d8d182090e449f0a04809b9919cf3ceb0aabdc56521ff8ac2c067e106cfe57c7d8a6a1e7f37bc4b298c3c6a601aeffd24040e60f4048ea64ba5ae1cb93f5e474e0ee4308e0fa1c6e09ada51956f517f323c84739643d04316026eb7e628d01b03a64f3961aca9db0f70599f393992", 0x1000, 0x34c}, {&(0x7f0000001540)="593c84023464a112531117864fe90c50213f452d1eb4e2e9286411e19bcdfa69ad53f995aa24ddc578bfe3dbe40923c9e96f15a91ad411d58ceccb9bbe58302f3a2e35b0e8f220a353722d3a56c4d29626c2dced28b77d7491dd90416d5e77a3e39d2e6bd0e04690c3ec85048eb4cf6130c99ad777b7bf2cd1cd8a8f37985b032e3c83298ed072ae46da7d35ff55ece8bc2a7af2a13688f5debc4f8d13a0f6da318153494095e8a425965a7bda67e19d831ba529a47cbbfa2a31222be72af7b1427055c1209966798289b7e8c9039d5f1fc2aeb85a14504ff029df0a378959def9982e4281e0402257d8136ea453aacd949e", 0xf2, 0x73d}], 0x800, &(0x7f0000001700)='\x00') ioctl$GIO_FONT(r0, 0x4b60, &(0x7f00000002c0)=""/111) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000017c0)='/dev/ptmx\x00', 0x200, 0x0) getsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000080), &(0x7f0000001740)=0x4) ioctl$TCSETS(r2, 0x40045431, &(0x7f00005befdc)) r3 = syz_open_pts(r2, 0x0) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000000140)={@mcast1={0xff, 0x1, [], 0x1}, @mcast2={0xff, 0x2, [], 0x1}, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, 0x10000, 0x0, 0x100000001, 0x500, 0x7, 0x80200106, r4}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000340)={@mcast2={0xff, 0x2, [], 0x1}, @ipv4={[], [0xff, 0xff], @rand_addr=0x1f}, @loopback={0x0, 0x1}, 0x7, 0x4, 0x0, 0x100, 0x1, 0x840000, r4}) write(r3, &(0x7f0000000140), 0x28d) 03:00:55 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:55 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000]}, r1}, 0x14) 03:00:55 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000006c0), 0x0, 0x0, &(0x7f0000000500)}) 03:00:55 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 154.438545] binder: release 13398:13401 transaction 225 out, still active [ 154.445557] binder: unexpected work type, 4, not freed [ 154.450895] binder: undelivered TRANSACTION_COMPLETE [ 154.472604] ceph: device name is missing path (no : separator in /dev/loop3) 03:00:55 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}, r1}, 0x14) 03:00:55 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000100)={0x3, [0x0, 0x0, 0x0]}, &(0x7f0000000180)=0x10) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) [ 154.514301] binder: send failed reply for transaction 225, target dead [ 154.548762] binder: release 13425:13427 transaction 229 out, still active [ 154.555783] binder: unexpected work type, 4, not freed 03:00:55 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xcb1fda71, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 154.561081] binder: undelivered TRANSACTION_COMPLETE 03:00:55 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) socket$inet6_udp(0xa, 0x2, 0x0) chroot(&(0x7f0000000280)='./file0\x00') r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x893e, 0x40) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x400000, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000240)='/dev/audio\x00', 0x404400, 0x0) bind$bt_l2cap(r2, &(0x7f00000002c0)={0x1f, 0x8, {0x2, 0x4, 0x7ff, 0x4, 0x6, 0x84}, 0x800}, 0xe) ioctl$RTC_WKALM_SET(r1, 0x4028700f, &(0x7f0000000200)={0x0, 0x0, {0x35, 0x32, 0x7, 0x8, 0xa, 0x3, 0x1, 0x155, 0xffffffffffffffff}}) syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f0000000100)="65660fec51029a349efc000f3806a6901266b9720b000066b80e00000066ba000000000f300f01d19afeff7e00260f300f01bb0a0066b9a40800000f32260fc72b", 0x41}], 0x1, 0x40, &(0x7f00000001c0)=[@vmwrite={0x8, 0x0, 0x6, 0x0, 0x6, 0x0, 0x100, 0x0, 0x5}], 0x1) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:55 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000006c0), 0x0, 0x0, &(0x7f0000000500)}) 03:00:55 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000]}, r1}, 0x14) 03:00:55 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) truncate(&(0x7f0000000000)='./file0/file0\x00', 0x8) [ 154.594972] ceph: device name is missing path (no : separator in /dev/loop3) 03:00:55 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:55 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x80ffff00000000]}) 03:00:55 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000]}, r1}, 0x14) [ 154.665523] binder: BINDER_SET_CONTEXT_MGR already set [ 154.672742] binder: send failed reply for transaction 229, target dead [ 154.698474] binder: 13450:13451 ioctl 40046207 0 returned -16 [ 154.729343] binder: 13450:13451 transaction failed 29189/-22, size 24-8 line 2852 [ 154.743401] binder: undelivered TRANSACTION_ERROR: 29189 03:00:55 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0xfffffffffffffffd, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000000), &(0x7f0000000080)=0x68) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) ioctl$KDGETMODE(r1, 0x4b3b, &(0x7f0000000100)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) 03:00:55 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x700, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:55 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) pivot_root(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uinput\x00', 0x10000, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000140)=0x6) syz_mount_image$vfat(&(0x7f0000000280)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x3, 0x3, &(0x7f00000004c0)=[{&(0x7f0000000300)="948bcb2a1f191769159b95afc90b857ee89d57c6c4007adfec4bbcb0409fd06a6bd9492570de432f51e8c97d3d66744c1808006fa62d173499d9a92f330b7f8dea130c7318c65932b41a5349d00003da51785146e225b8daad7224ada9240184d5288c948b2da3975015", 0x6a, 0x6}, {&(0x7f0000000380)="a450371b439b1430d61f0823ededb262f9ae34749e0535d704a26f68085f972b7186fd88fe9cccfb2977cf3236d58d344d7ae683", 0x34, 0x1ff}, {&(0x7f00000003c0)="bf3079fc5155fa545adc569e3dbf81b6230dbbd82ec3e6fa5f1dcd46b76f5748862fb9273ad225b50b8191bdf2776d3ae86d4a398f9296c4b6d44f5b75a7fb631e3128ba499ef7ab4d2bd1262efde1825920c871895846e37cb02efa31eb85f6a9e967a653ef241eac8d00bbd6768845cd54b3f87045696f94a7e801ab892b3db5ca2af2d4fc63aec6c9e3d1e4346cf5f7015ee4dc27853e61f4ad7fc544f6277683d9e9d270ec5c24d25e2c2c6eea55f2cf888a0726664e7ae7a5c837e9352f7e647e30430510e935873fea3e4a4223a64149f99f54bb604ef1ffd28b6c290c1ffc4b4cd5c039d6cc35c52ed3d1", 0xee, 0x6}], 0x0, &(0x7f0000000540)={[{@shortname_lower='shortname=lower', 0x2c}, {@uni_xlate='uni_xlate=1', 0x2c}, {@uni_xlate='uni_xlate=1', 0x2c}, {@utf8no='utf8=0', 0x2c}, {@iocharset={'iocharset', 0x3d, 'cp775'}, 0x2c}, {@rodir='rodir', 0x2c}, {@shortname_winnt='shortname=winnt', 0x2c}, {@numtail='nonumtail=0', 0x2c}]}) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000180)={0x4, 0x0, 0x8000, 0x7e, 0x3, 0x222, 0x200, 0x32, 0x0}, &(0x7f00000001c0)=0x20) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000200)={r1, 0x3}, &(0x7f0000000240)=0x8) arch_prctl(0x1003, &(0x7f00000000c0)="7bd643ab2f6ce0fe0569cbedf70389ba2b1baf20b5") 03:00:55 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:55 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00]}, r1}, 0x14) 03:00:55 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') getxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@random={'trusted.', 'qnx6\x00'}, &(0x7f0000000100)=""/30, 0x1e) 03:00:55 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000006c0), 0x0, 0x0, &(0x7f0000000500)}) 03:00:55 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x80ffff]}) [ 154.824400] binder: release 13480:13481 transaction 234 out, still active [ 154.831411] binder: unexpected work type, 4, not freed [ 154.836720] binder: undelivered TRANSACTION_COMPLETE 03:00:56 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:56 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80]}, r1}, 0x14) 03:00:56 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)={0x0, 0x4, 0x0, 0x2, 0x100000}) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) 03:00:56 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:56 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x5d8, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 154.899102] FAT-fs (loop0): invalid media value (0xb6) [ 154.904523] FAT-fs (loop0): Can't find a valid FAT filesystem [ 154.915099] binder: send failed reply for transaction 234, target dead 03:00:56 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304}], 0x0, 0x0, &(0x7f0000000500)}) [ 154.956567] FAT-fs (loop0): invalid media value (0xb6) [ 154.961972] FAT-fs (loop0): Can't find a valid FAT filesystem [ 154.980777] binder: release 13513:13515 transaction 238 out, still active [ 154.987840] binder: unexpected work type, 4, not freed [ 154.993136] binder: undelivered TRANSACTION_COMPLETE 03:00:56 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe]}, r1}, 0x14) 03:00:56 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000200)='./file0\x00', 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) mount$9p_virtio(&(0x7f00000003c0)='#\x00', &(0x7f0000000380)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x200000, &(0x7f0000000500)=ANY=[@ANYBLOB="747273d2616e733d6f05af07000000000000adb5bcb3066c73d1f2c6b495ae4e718b996a68c918380829afe34b39000000000000080000001b5a378b7201e3f2445b5b49b1b2ecade5333270a06258505e593ab01d444284b8670f140435984f3f569f9d5cf8345143ac8ffef2d1f48410fbc500e4720a01b7490979c0006968a2cb224d11754b3626b1f699ee6f51796702ae3200133b76ca59e73e4baa4017206a82a90f5985c3d9f185bdc772603c8243ec90431aef679fa02cee7690a9e3f868abca17f8f08dafb58fae4996c8d62f1b36"]) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x1, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 'bcsf0\x00'}}, 0x1e) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) connect$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x3, @dev={0xac, 0x14, 0x14, 0x1b}}}, 0x1e) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f00000001c0)) unlink(&(0x7f0000000240)='./file1\x00') mknod$loop(&(0x7f0000000340)='./file0\x00', 0x0, 0x1) ioctl$SCSI_IOCTL_GET_IDLUN(r1, 0x5382, &(0x7f0000000100)) renameat(r1, &(0x7f0000000140)='./file0\x00', r1, &(0x7f0000000300)='./file2\x00') [ 155.037819] binder: send failed reply for transaction 238, target dead 03:00:56 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:56 executing program 0: r0 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x80000001, 0x1) name_to_handle_at(r0, &(0x7f0000000140)='./file0/file0\x00', &(0x7f0000000200)={0x24, 0x4, "e20b7f426c7e7d0c83606dda0c2dbc734ac527cd3078575d5394e8ac"}, &(0x7f0000000240), 0x1000) r1 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x101000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x0) r2 = open(&(0x7f0000000180)='./file0/../file0\x00', 0x80, 0x9) bind$rds(r2, &(0x7f00000001c0)={0x2, 0x4e24, @multicast2=0xe0000002}, 0x10) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x180, 0x0) write$P9_RREADLINK(r3, &(0x7f0000000040)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:56 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0xffff8000]}) 03:00:56 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$VT_ACTIVATE(r1, 0x5606, 0xff) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000000), 0x0) [ 155.083711] binder: release 13532:13533 transaction 243 out, still active [ 155.090706] binder: unexpected work type, 4, not freed [ 155.096036] binder: undelivered TRANSACTION_COMPLETE 03:00:56 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x10000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:56 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304}], 0x0, 0x0, &(0x7f0000000500)}) [ 155.130970] 9pnet_virtio: no channels available for device # [ 155.141125] binder: send failed reply for transaction 243, target dead 03:00:56 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000]}, r1}, 0x14) 03:00:56 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400000, 0x0) inotify_add_watch(r0, &(0x7f0000000040)='./file0/file0\x00', 0x80000000) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:56 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x80ffff00000000]}) 03:00:56 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 155.211087] binder: release 13554:13558 transaction 248 out, still active [ 155.218165] binder: unexpected work type, 4, not freed [ 155.223457] binder: undelivered TRANSACTION_COMPLETE [ 155.229664] 9pnet_virtio: no channels available for device # 03:00:56 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:56 executing program 3: ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x20201) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r1, &(0x7f0000000140), 0x28d) 03:00:56 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xd7fd, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:56 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x1, 0x0) write$P9_RCREATE(r0, &(0x7f0000000040)={0x18, 0x73, 0x1, {{0x32, 0x2}, 0x81}}, 0x18) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:56 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000]}, r1}, 0x14) [ 155.288618] binder: send failed reply for transaction 248, target dead 03:00:56 executing program 0: socket$nl_crypto(0x10, 0x3, 0x15) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:56 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x80ffff]}) 03:00:56 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00]}, r1}, 0x14) 03:00:56 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 155.378713] binder: release 13583:13589 transaction 253 out, still active [ 155.385735] binder: unexpected work type, 4, not freed [ 155.391063] binder: undelivered TRANSACTION_COMPLETE 03:00:56 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x6d8000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:56 executing program 7 (fault-call:8 fault-nth:0): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:56 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f00000000c0)=""/150) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00005befdc)) r3 = syz_open_pts(r2, 0x20201) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r3, &(0x7f0000000140), 0x28d) 03:00:56 executing program 0: mkdir(&(0x7f0000000100)='./file0/file0\x00', 0x4a) mount(&(0x7f0000005000)='./file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='f2fs\x00', 0x0, &(0x7f0000009000)) 03:00:56 executing program 6: r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='\x00', 0xffffffffffffff9c}, 0x10) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') recvmsg$kcm(r0, &(0x7f0000000240)={&(0x7f00000001c0)=@can, 0x80, &(0x7f0000000140)=[{&(0x7f00000002c0)=""/127, 0x7f}], 0x1, 0x0, 0x0, 0xd4d3}, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x1) [ 155.480789] binder: send failed reply for transaction 253, target dead 03:00:56 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80]}, r1}, 0x14) 03:00:56 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:56 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0xffff8000]}) 03:00:56 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) [ 155.526577] binder: release 13621:13622 transaction 258 out, still active [ 155.533569] binder: unexpected work type, 4, not freed [ 155.538875] binder: undelivered TRANSACTION_COMPLETE 03:00:56 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x3d8000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:56 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}) write(r2, &(0x7f0000000140), 0x28d) 03:00:56 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="025cc83d6d345f8f762070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f00000000c0)="c4824da82b66ba2100b801000000efb9270900000f323640a7650f30c4e2899c8e02000000f02046452ef3440f6fb800f0ff7fc42101dbc40f2047"}], 0x0, 0x0, &(0x7f0000000080), 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000001e00fb034d564b0000000001"]) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f00000001c0)={0x2, 0x0, [0xd90]}) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:56 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe]}, r1}, 0x14) 03:00:56 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) open$dir(&(0x7f0000000000)='./file1\x00', 0x10000, 0x100) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') r0 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x7, 0x10000) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x0, 0xffff}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000140)={r1, 0x68f}, 0x8) [ 155.652467] binder: send failed reply for transaction 258, target dead [ 155.687224] binder: release 13647:13649 transaction 262 out, still active [ 155.694223] binder: unexpected work type, 4, not freed 03:00:56 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:56 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc020660b, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:56 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) openat$cgroup_int(r2, &(0x7f0000000000)='cpuset.cpu_exclusive\x00', 0x2, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write(r2, &(0x7f0000000140), 0x28d) 03:00:56 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}) 03:00:56 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000]}, r1}, 0x14) [ 155.699520] binder: undelivered TRANSACTION_COMPLETE [ 155.721983] binder: send failed reply for transaction 262, target dead 03:00:56 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mount$9p_xen(&(0x7f0000000000)='qnx6\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x1, &(0x7f0000000100)={'trans=xen,', {[{@version_9p2000='version=9p2000', 0x2c}, {@afid={'afid', 0x3d, 0x200}, 0x2c}, {@access_user='access=user', 0x2c}, {@loose='loose', 0x2c}, {@cache_none='cache=none', 0x2c}]}}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') [ 155.770261] binder_alloc: binder_alloc_mmap_handler: 13670 20001000-20004000 already mapped failed -16 [ 155.783440] binder: release 13670:13671 transaction 266 out, still active [ 155.790441] binder: unexpected work type, 4, not freed [ 155.795857] binder: undelivered TRANSACTION_COMPLETE 03:00:56 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}, r1}, 0x14) 03:00:56 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 155.830946] binder: BINDER_SET_CONTEXT_MGR already set [ 155.840770] binder: 13670:13671 ioctl 40046207 0 returned -16 03:00:57 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x8, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:57 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) pwritev(r2, &(0x7f00000001c0)=[{&(0x7f00000002c0)="3ccf6edc08496fee817af9270251bfdf74aef0cc149d7890a3de6d8dfb80c3cec10cf27a21bbd6f482573e880ce44fb5dc292fd82570cf98b6111102afcfe510b832da02a9f0851cf989282a47f0095bb0758b11962571cc0faa9e546c3e812cc71167dde19b8d0c13491b0e29ee96bede55a3a9e612317cac370ea98d7e4b61bba3ce97f90b0783f3cece7a6f005755dafae60d045ff03655a307c4212effd272d8a0405c6c26ca3f827aa77fedeb69d430fc6eb6f9e417d21ddcac644ef866c4faf8626518d8d06999feef63be4f4b6f961f7a58cfb05c255b5634bb49431579b37418fdf0e14fed98905bca7ab56e53c027ca68392e5a47ebb050ad536c24d1da7eaecde4828ee473a6bc8b66aa054531ae2b2c965d10e55bab7a7a4c9254c719d486279078df714161883325254089bc36249d4ca300eb3399afdecd05e91c55acb88f0d39d3351530d4b1672afa61072204e1b3270f75d883c0588a72e99cd2cc632405c9c576dc3e3d116b1a10a1b6c704339d619922101995fdc4dbc2c8b16cb3847a3a9b420a39c0d65ed736edaf678d8f0664cacc833b6dee5b5f4dadb00c97e88d9e56bfa7a08e5f2525f535a86a026dbcd693d5de53c9040439fc84243e51a57daa29cc3f2658c2616789e14adc7d1aff00567da4c3d22803b7600918899dcec12ae9b69683ef8968dd573dfb2c055abe0d9ae12602d42d5f3d10ded5ac85f027db1dfdc51a4d6022f6c3c9c1125c30d97b866611fa76e22057cc93e2f93b6e2a4315847be889eeb07fb505f390c1dac1aeaf40037104c6ebb9b996869ae11b5f398a82ff5dc38c322c3120f1a55b3bc805c4bcc726a4dd7f2566cad0e42b4d51a2a9896fff86121769e6988c9ee1009d966da3e46a3abdd439dc1d9330e8c00991e3f0619925794d7ab7ecf78991235412f1ad540de990bc6e8f68c8b1117d15235d53f5ae825ef8b70fc239c2a3bd5a59ae005dfc0dcce051ec069c864b9dfac9eadcf0ec7cb79bc2175228cd2464d6f95761dae9b3d70dc3232dafe2d5892183f3254c1e32d28058915bef258dfcbef8808cbe5ba51e893a5030dd3b887280884d1d5cce81c218c81241db44637fd43ead3ad9727f9b5888bbbdc224787509aae52065015d35326bc763b35c510b1e876970dab0a4d232c5f868790b8db2bb119b47d15f3c7e7b590c7abd51021b4ab9807532500b17f957fe0c9fa07240be56ea376283b10b88856a9878fb10c1ab62870535ea7ad2a46c31ff6d12c572797d07af046c9e5fe214c39853b7cd35630a7d178a1077f37f36970d98b0199f5c274807dd29be51bab6d0978acc93c5a5259936d7b6070dd0e253e28f9ce7a9861fcf8a3f9a0d78e6f1f2a3cda1b9e8ff94ecfaf685ea41935d8bc9bfdb529f9f723c619a9bbf11af44b0d3953d71dcedeb507761b90d8d32ce064268870e1a9a15b7272d4cbaca437f70f99ae0a84549145d2b7025d286fb154d367f2ce9e12afd0bed603235e103e26a0599403e787560288ae3372a61ec9375dfec512b1336083dfff4ca390cb08903f3947f664cbf56f2c249a68c9bbc8c38e12743412af667b6459080b02d0ebc21c01efbd04cbb44bcfc32d966d16354194c92b4693b05c0e603edbed82a515a7125902eed872028be0b2108328a189caa493235d32d6eed8c7c754d9ca920b05788b2f4ebe2a520e40f2d82063e762080a07bb61ae5674faf08355dc81f76b77adf81719d843ff4c2b3f57958e2b1c20e85d4b661c379e2854d931cff37bc4b4a835251ffa7b2901f916e832b7b803fac7884a6ba87ff4b3f4526e418054442913f050c446873491614243a199b1b30850c7fe57ea30f33f14e18eddd6d4913677503a491c0da815ee5d6140a43a4271019e76fca60fb698574a9150aaaba7dee65047a4dea0bb695fc5a99e8c34700b9e02f1df1e6d40c744e90cb69a564cece13258bc21668a4a290b80f1c09b6c97ae3e49770daf7a16421fe900e983d2ab8cda9e4bf88c26f30c1b391900bf04ac2eb301ee0a898bc708f6a5d87aee32517679b34501de6ef63bfcd806596001ebcf6282534aa3890584792df8d8fc4e0b9f99c8b78c547ef54e4f3b0306d8ca8b7e8f246e3160247a3c72093d93af6745b623da2ebc5cef7fa0f5d0b0f7e6e5359e3336cf05bcefa97fdba2dd4e53251d63745186b60ad988216fb2ef1e9e7982421dcecb5cb8743d356af31b3ff8d0ed353ae39cd7d38fb2ee7d3022f71cbd5dc26505643303217e2f9819626b98755faa656584bb84b4be0e72eb6a23c79c1c057ec1294e800c2ddc24815632c42b7f953c0d8633afb3138e574625265bab1054d400f6cec13739103c3edf120ec20ce1424230fe63a1f2b475928f1fa2bb209a41ed4f7f590ff6e258bed9e4094f33d576a976aa0ff8a7eba36f7f9433b1c063eabdd5f46849d35f3407dae735321dfdbf2f971f0eef58d8b21f8b1f1e4dd2d4cad06c67e862ef342a2ccda81c7fdcd4716dfce043fc052c4d0531df2d7a1be8d9710cf5ab35b736f5dfab4302fc5dc0cd71f4e957cb30ac57fc16b4a06b3f152ed5ffdd3af5ca1b773c34d67a16278a5927971f4bf4af7c9d0081364c29b94a70a0ffd4760bd48c203d33aebbc15582f774ffdf5c152a8517cac12a7f833ce7f4c11e04a038a9107cb47bce77e0a00c563317b083116d701fd61b07f5cc8c378383e7c726eec7f50d351d09c78212708f2d1cf466e72596817cd309547fc3ab583ee830a4fc094d55c63d3ac781a170e1f6cbe03ab25fcc9be74b1e5414dd46c755c7e3eac74d90e86a09c5d12092f2cc96ef3c8ea272eed035d87653ccd05c37263d3689153178b1b3091ee1b9caad6306c8e89edb6efa7d433d7cbcb8ae9fe66f78867c0af50bd2257010117ee0959c2e72eb649161b41f0c290b54febbb05310bc98726d5fb9ca40d502f2bc0ac8ddd662544c304419468a331d910584a6bec7590733c6212175da9420ad81dfed149f5d5cb3e5acca5cd1352a83f16f88c9b68abccf05950627e519245f8ce6a1397b8728de385a18c35bc30a47fa22bdcb119fd034c056d8733b0613d8d301b71b106bcb46d9cd3535302c29c715448775f3502025e506bdaff3d86b7ea42a2900ecea6cf562fa7c28bff9f4d6d38710421b354bfc589e845df22a1f39c3aa19444d8967970e5594d71d905560f1757703b355a073b7c2af2daf47d73860be129e781490e88bd9a70b40d2abca12441c9ab27621f895cdb7b9572746bbe09e15395d09788f23f6a86b41b9b3d1e1e2cb436212eb2537e0a5cbe9e36e3d72ec6adfea3fbb87cb3611d9555fe340d580c5994a4e4ab72b646e4604325f8d7dda0614bba7acf348e27e26b7a9c19ab97ab96e219508826b2c929a08243816d1b22d0abeafd2880fa1ecf24ea9c99f8ea215873948c21ea843d14508224d107f847be56230ebc4d44ce3d8f471524d922d82681ae4d1c71b65fd7278eed7fb2c983c0c75c2bc45506a2e88711e47feab8c2efa1ef19aa59e736720948e71e586efed5369cbc86d69d8be6a68fa2febb60b3d9d3c04a0465f0352c9e41757d78362049410b7cc97995e441bf0a8ac570c0c064186a8c98ce1c92f7d388b9a3d6b93360356a2a0e4485269af04658b5b9927656af130f44fccb4df0275179ad474d4af62229e919da826b0db9450372b0dcf23911d20c8d0b933e7d4d264419d1b82f3cc6222ed262625e1b18370ef182c0db0659d3213a7f844c49396d7cb308b4f06e7e10cf999e42f3b9ec3038936c292053db757123fe7b97c2dd7519c759a478ffbe98d94f262c19a6b7815c342a52633434e6974a1f5f5c2be7d251ed42d8f3221b567a8c773d5c2cea79372c95ab551f2873291c1da56920391a56dd4e55cc59a8137cfc30fa746b2f3aec66c0844bb0ee339f098b4324bf9608cd302fd7d264df8f75b8a13943882e61dee6d1c1ae7f7f440dda19e570e37f46c274081350cf33bf39e3c775df1ef673d527dc48bd54148a29f0982dca05bd9239f5ef5a27ba2e468d7f295518bfc92ca889c49ebd852c7d3125960474460237b9897e9206d9bb5ae0944ba604f38a78e3e53e1281db642841b72f3eddf38e8ca3ccfa631471d7f05c1379ea0b0165d4aa9ad13568278fadc32218a99eb25822140fc133d71ff7d62eeed75f982d18dbaa272065fe0ca3a3444c066d107ae9dd793412cab3aeeeaeb6cbd94742c7a683ecfd85ed6ed63b6cdea13e4167fcaf2dfaa448b77b0109269ca9163b758d0ad6b34fc76fad3fee343567816d0fc4ee530cf35e0842a1d3fdf0ed4d5a80b406ab2ca75207fd54132dace66e00106a171ce190b0558176dcab0863e1bccef7f564c6ac2dca03f2be4c6993cbfee8e966dd912d95da1df4f1d110ff8d231371955f90f556a334fa7b794bf2705f82b7013fa921bfe4e8ff91a946aabb7a4534508cfc2a4a3ef61f4448f2afb1de9dd77b441bb99f7172b6458e37863c55d8ce39e6425d5f70bac484e73558dfc7da3252df82f1e81c2b8b5079c69da584b757f85c95c5ecb36de8f10364398215dce6545cf57bdf4fa2c52ed276a6af648828b2f7cefbf5eed10c8210e9354f25917b342337f4b1755cede60a067de332fb532de7c067ce690b56777b4a9a25aefe5203249d0cf43f6e6cd8c8835c939b13c7454b883645c23c76876a47104daa85678658996f7f462919ab8eba2323ca2dfbe34e49763b0674aaea06c726084adc08114c411402fa24ab063b49998e3f6a1723534452b1e08a0c2790da9c42b2e3aa79628fbfcd2807148af031ec2cb3e8b119df267be26e6468449e8460902b5ec47b1201053d9a0e2ade7e2bba2590fc944b506cf7025dc686406f7fcfb4075a966073dc32b7862be90b11665eaef786a45efb684690a6a25808829f5ca11acab98eb1e61357f38d2843d298afdf8608675e3742348d602b06ed7089a5e58c5816b555c3c95f0a5fa9fdde24621f5b26f650dfbe09291a9ceb9aaa2d1e2781e4537541f6829aa688032da56a21fabedb162ead4cbd72f24b12101d1489c9a415fca4be7f9a01f9702b253e3621578f712cea72551e5dee1c64858a2ff8648bc6dc29def3922eb6077dd086afde617ed8e7dec59b0883b03a12df3ca2cb079d03596b3047a35bf3815d09187e28f6c366ea56a60ae1c7cb7d1b4137d79fed3d1effcdfa6fd6d064e441134d02651c5f23542941bf2fcf408dcc774811f6b80e796372dc7d01d21f51b758516f0df3c778eff5f16932d5eb81a7635604d7be30af87e4081c272b79a633014e2c5ad7e74e1b468bdc30524e12d1703582498d7d5e83ac79f1e1a60017719525f7c6fabe5b91fdf7b2223a1acee4903236042afa8d79d5d2d0a72555a5ed656147d2a2ded8ddb00b07e335088e7a0791dfec37d7a42f7224282b0d14b77ae487c4c3ee51ccc7f473ba7488d206f23c0e738546e80ba64f21670794b9dc036f8c07122b5fdef3c4ea45c1fb3a0c7ff91b21d58c5fd0db0c7bd18f48f21d12da639836661b6548a4f4668d65986a09c85128cbd27c2aed42ef168927f0e428aafb5afb691a39024d1771aadd440fce47db730bb0f96735a06a55c229f3ec9407c0e2a03623259db7b62e2ee25c2c794832eeb2bfd772f25284b0365add000b989442318aa6e2c8660a84ff9590e1ebd286aebd8636acc92d489019cb6079f14f9cefa8da8a11a9d41871f33e6c8758e014f5abcd5554bb05d9296aa86504d9f5f791e4fcb09fec743d19614dc7ae", 0x1000}, {&(0x7f0000000000)="04bee9ec6c98678f961e5fd6c330d14da041bf72403e0267b458b68c381ba5eb6d2ca9504667821db73c1a7ee87b04d0617093e16ddf5c850d2a912231a576ad9caa2f9310b35435bb6ce067843d3a24633c1b946775ff885839448294042e30efec61da7c180907248e6787d6c48f", 0x6f}, {&(0x7f00000000c0)="727f5b44a81560980e737844556ab2d9f4bf8630f762e040a99f61e4c2df55f7b9d48988e045fa3b73d9726305ccd0aa8ce93e397c91cdfe5a8a2263ba3691c65be57525c1c8995c667801d7f841426f34306fa9a5b0c3d6e054637ad1f538d4ebcb1ca98ad50bed775f5a582cf0396093a8b654ee8385511943139024dfa95021e973454549ac6e0bfe562a0d6730face5015ab3883f4906544daf4fab0fc9c5e95d03b87dff26bc770ade894a107d0e9cf3cd1c4ea7c5896feb7a3a9b0cbe2342767acd76479d0da76344dcc0b3707659b8e6ee7b52e56b450e7c81e0ad8f46f4c0d6ced63603d9ea2e8f6ff45cc034f73f23897e823b18346593a0ee9", 0xfe}, {&(0x7f00000012c0)="b3dab2a7430c7dc198173a8dc8009dbb84b96867eaf837c7a0a32d5447c5f6baeb201f6524bb4c2602a5da6e63bcfb76cd45345964edc1cccbbbcc9076e02f68e0f305a3822085348cc0228d6d8388b9922e61a01203b8afe68e69e600a33d9d6a9d4aa8abf3c73481bd99734919d0abdf9bc484df2b3f61b0a05247ec34b01b01c9cbdcf1a53ab480fba03f096c129802e1c0e53897ce5da566db5635a5fb732c58f6f7749f8d7890fbd5bcdfcd36ab5ae4cc7c05b527828492d126dae33df778c4594e7a9803ee4cd56b3efb8ac5c08e017dbb67dd3ea33a83dc3827c202c9eb614c2d5a5bf347b7021795758e0e96dd5cb9a6d37cfa7e9c746519c84de50ec2c2b4313bfe9d7b68107e74dff957e29d04201a2961c4badb1700b69299620e4f652748c36f066259c2d4d2cbf462a1e97f30d2ba5976b8066a2918a8881f379261adaa59ed45fa104d4fd0bea6d01ccabb6f1dad8944149c1396e61cb582fa39ee730ab6739cc6235fd2bf51b27c325cf0cd420a8c3371d4e2a25c529e118a806824a5cada67b23a22045813bdde3d053f03486dbfa4953fa35f5a769a336d7d780781aed1f335d6a63ed498781430a39b029ba737766ecdf475a6b118a12176778e565110a39ee2dfeafe161344d0a02e1848d200ea1d316065901da5dae7a90247c205144b49a291ade9a057bdd119010d84b14fec588c92f71245722b6c2cae984185c6e7c1ef4a5df9bad01dcfddff94781bb857337a1fb32725abdc8b0a05b0f87fa3319e311065ccc1c9a0c7a9ddd40efdf2c5bab2408af2dca3e9d2eef7ec1e361a96155bef61295d758c6fab849a45927c9ec94069885eb9739a84f67d63b32a2a4add2cd6a15fe7ba7107b4a2555d03ed3a3c6950b41a84486c68537b56f1fe57b23616ae5106184d14decfb5c288938ba6326e06b27a394226bf300ae28568f3f430556130cdddfe54c69cde181a856681dac43f8d3e77d6157ecdee44ad8f6f6bf72c6767bec082c481bd3bfb6d819071533f3526d732c72f459a6c0a0aed0db56b19d2a06efc303edcc86ae87f5ad472f0b07de7e28f9ccae9290ff881243ec87c53614ed6e07b1e8551f82a9df6ad486c53c07137ddf8c79593374d0e111fa6a408e65dafb2eb6b6b8c87c118d6bd466c210d488c8ec4928c29f50b2f6af0397dbdcad50081ea3ac72ea79dbf9a30983389c0082a7642834e325fb5d5432ff806d9bfde68581155388917978c14eee426f52c8c33f849c8c06ddcea18cd095093ff3e227f0ee7ea55e8834e104b740fb9a040c6f98f3885a73f7d5f1b75d886b780bed771210a5ef07b9f28900fad079043ec474d8360f98eb40fe9cf8d212da43997fedff0f408726f9b304e39c2e040dacfc3ba5dd10c45e9e2e1c547e943ab76448e3994110434859db477ca91a2f40e782c1609309ebb55d0eb96514e094897ee52805ba3cc6d852caba0b99aad9670c90800ef819d95fcdf4f7bad9a4b2b4b3ebe884b21c867c3ac7f1f0ffb3cd8046e767b558cd2156ed34ac62d2107e8fecef7e8e44b95ab8d367abc7e5648c60fb4dd1a73ac576675c7e9238582f2887de7bac3fa9311604ec6d8d18e9b6372268de70313359c603d3910172f468c15365bf84efd9911729e41eae70b93c402d48a31fe23f8b9d84cd4a1842ae28a6ba80269246f1ba7312bd9c2f19814a2c621081c91e4bc8f556dde5252ba598a3467e54b2e07f467ad30096decbcc75e97f5edb183285c5c5beec58d2ea5ecf9f7ee2bd6dc0872afdcfaac6a7451ee1bb1b229bfc87cbad0353f67231c6bbec1f8563f460a145ef63a9a6dea70fcd328cd87252cca5671229a5cc9d93a102591dafdd888c982b3025ad0f74dd10c1eed8b607216f14f7b6763d3ceb76c2dc56655aaa4dc72ab93699b7f5653a49b9f12b766e5b18685ae35bfbb86b89efb47d39c285e8bbd959131a95e9f64e0d0ceee4549ee1f97bbc228a5989bd5e9f0343f6c58833d99ee7fa028e7ff52e6d576b3ad237fe787138f253a68a97154d7441081cda98bb2e95dbfe880ea943cb5c315132cb12cdf67f26ada91e1af0621901b7c86ff7074a23af4186d056a67419f808060f4184378d0b5d48a1a223af50c5b5ed5176dc06a12b244df3cd6d9a3b5a59a38b52565148d19ef5959c8e04dd7a59c6f8a9ae0d2daab4cd467f832ca734f05e49d8cca6a0decaa4a833c77922a78626486041cbf5fe492358c1813fdf0656ba9c092e59a8ff8ec3cb1bd95ba50ca64cfefacab0254afec01884681fecfb975ced7bbe6a34a4ebe6b6beda5f2a4e8aaa6b9650c2a511cbaeb66277238a8dd4466315f7b3f33262e89ad1b117a1cfa3a8408766bb9842aec5117bbe4e42c0d44daceff9225c1940ffc31c67f08dd5eb17c1b68ccd3a83bb371e265efab200b2036abc3ff5e40c335af690e1abea74b93fbe67527737853b8a069b33da18403410a6d0284aa3e9a32517e1d9aaecdb5b6db594215dc8942531574022dceb90f2fe9061691b823eafe1981c100bc2d214e9ca1da9481bcbf45c91c4a60f5ef9ec6a48c1c7f9c6230192a27bab28c55a7b6ea2fcc94bed1bb1cb4b770f93ef0c16d4f16092c791bbbd258c3bbbdfff6e854977f9d9a584a6bf299a7250e84d5027d8d8eb72866d389ef5424a4b140c0c80fb414e1cf449985e82c55dcea781b7270cfd283bc7e4ceb7883c5a03797ca82da1ceefae22e428ef726d67e283068a75bad9af9c6e620e7febb0984e8a94b81b7e8b741ab268e5c146650d6611f1a95c5972da1ed7b0868f63a2a8160377fbd337fc268599090ea22d51349dfe9aded95821b7e30e99b1eeb547552a472e0f15bc54706f0034b678231a464f210617bd935c3e155a502c3abfc86c9d972de3bddd974b8ffee780b6ae9adbd77c4d2414d00c9814186eb96502778226cf0106c24c51501bfba917a9d1f958ffb520cd508aa0373446473a64537d7f265069a4f9684bcd6733f2b609a0f2e9d5e73a590200abce5b128713ac54b618872e529727208286e8a03111f5e564c576f2490c6acad40de4cdd3144cf6c69cc6e14f07dd6f6d4ef431b62de21059bd89e28fd362c9baed49571272fcaa8e36c3878facc774a5945fc1b960ce886018b82b863c04f8ea49de4f5744dc88053f6c80508c43b7efd3acb3e97c2545d629cb90914c32365df3da88db7be73cff024c4fbe3e7719df88637b5148870020f5a37d17f24cb2ac4da2cb1985a64b4f7246dd06f13f8f49d8fb4fee1b6358d617675fa7eff72889d731740b2adbad4f7c77b1e10653d3475f0f4b9daa337b9dbb6c4f1f4527791c899abfe55c3cc1b3c303dc908c3b062ed1950cea7c6bcba3905c01f15ca389c9b4e8f97292a7a1bd12f598c94f32dc1e451666ee7b703e196c17d6283f017fe24a70bec342a4a8611ffe4c4cc47b0dc7ad59d1e994df887dc620b5fd55ecced0001695ed63537e4c059d8941051cdac38492ce0dc19c872cef2f00e7b785a050281abcfa585610d2bb3cb43807374647073e17e7a5d791e5c3d6ee37778940d02b9b81829104619fd9934848befe0115fc16cea1baee44a4d19552ca33e940c97bf6d589c12447987f8038253370d826c6f00bb0eacc0b48a5944876534aa25968a0abc67d7f15f0fc2aef4b7b27f35f1f704a72ad482ce1dd6b0280ca5e758b2a6da90d8c5f7ad0b8029a5e24f17be97b89cf665d7f570802f419f45e1f9744343bf529152c2438413779f5bf2a3ac559a3c07a2941327d948f32bcee2f3f64325d8510537de7c0403b28dcfa7b62cffe3619c66d149df150d51f199d4f2b44fbf3911c4de85d07a4269a6ae6be289c3734094bf714465821fcd7d25315b8a91ea719e1aa16529fa41d71a80ed8082748d85bdef03dcad649ad75c092d21b543bd5112c249cae2ebca525f614e6f68fd45d51af74a15e2f29cc131bab88a8fe6f533931ae657c8b685924ff91a89ee5193db0365859945040ab06743a3c5b11f51657408d72d13aa525e4c4ca0b2a75f62c9a27fbc3553fcc9cbc2b8da175e729984bb659da373f3e2d293107d43e0dfea5bef1948c807074351a9caad7adc98c36a3450c98bed94edffb0b23dd69604f741a009c7e024b9f90df69ece7b41206cdbefb55d680bef556704900b1669e737dfb2f53cf0b933c9f4a6e046387ec6abe1b76032ed860f52d75ab44a36dfcd9f8de0d78199bfd53a627f71e6087dd7520b69bf398d1595dbac627053f33fdbf85859551d83fceb77a45b0b97eba42a7f7ab9e8398aedac495ea4a3ba099b8be1dbea60bbd1a645f72a27bd2d3b6f6966a4ab4f2e2fd63cca30d2838864c3d813d510ade25825baa6940dc754208c70fd638088c692c5f9d04d31dab808362501cfdfd281f589511936d6c5e0aeb561187bf2b2c6d533ed304d57b198ec7720df849f694ae7f18d480f76d2a58adaa04c42f8025dc24fff0bc5a5e0d830e64c987e79e1117e1546d97564e55c636d210eb4a978fb26efe667edc4a81d036c38241305c3372b86e29f7d73a97863c90fc2c7b777edeafc3a5c6ed6f6f705d03763a1478e56a36eb550f11c3badbf79238cf21f339ac41dd24ddabe7215935d18145aadfdd361665e89077a44644a3665b34a5e90349a88ff9e057403c1c3eb888c1ce18b31189ffafe3af878956e585bc4f2a0c9e68b4be9ae9dd893a0b7ffe3a9fb631d9494b1f609475603de12f6ad4ab1efb2130b536792c114fa47d79419f5ba52846473f75fd12d565efb6e4bf3771491299c64e054a37997253449abfa3633723dc8a8c8cfaf61070f3c28d36c53739e85c0139e771f9709905c93dc6e7b4fa77d9ba3c759b0720948a58a5037b10d87500e252868a525c2049804c3cfeab13465ad4e22b8b22aa69fc07c7605bcdf79a367ab1e68b5338ef1ec5842b36ab1e0003ff5f13f8b05388470d49e94a298f2101a43385cb401a35a1244c371652cfce613bf7e17df43798ced56b4c9f3030f0b66df50bbc58d98855bcd316d44653f9a81eecd51f345e5bb3c408a966a437d1479b828f1d158ef43ae753bf8e8a5ca2163a560864b2d0ebf9b1e8f52ee12ba9daaaa2a8da26cb8a9f61eedee05a3070d3510f7ca0bedccabe6ec011493aea38b0e522040be75d0106797f92cce62754dfa43a9d77ecb36c561a4b2129ee283a16c9fe492ff81e48f73ff00e642632080dee6cd440b2c5f5db1e804d9d1fbd86e10609c98a7e14cc151dbb0520690e009459876429f7ceba2b34d66db4add64fb3be03c530509dc3e8c379c558a5c49c48b593866772b06347bc7f88ef563b33dc28ff5fd0531e510b4562037131c79038f308a11d119e600be7f65d2260ea4f70d02a6e504a4ec978f598ed8ddf9c74637ecc1f039393710e824ddf435fcdc2d857d2829bfca3bddc00c78ed38b1d2d3b7e76d79e3ee949c022898c8ea08d865e68077ae6009a02453f837a4ac9c108dff1108b3941db11cf32c83a03863343ba7be1095d07ff08e6fd2758d31743ad4a3ad4d1e7ab7ed667fbff2bd1f6f2c5cd8452c5875575ed77d61875b0d02ff17361e96eeda5685c3a269ac4b973215348c314d5f061f27a7344501f99423803de207c06dc5fe40472f9cce276798b97c6d26ec1abb36a11fec5e479c0fbd1a2da303afebb40d1919675fa4efc828e10ad729d057fe80bb62c8573574de9de04fe08ae9a56f0e798b9b048ed1449a6c8828b8982f36931e7e05814e50835b73524630bb5810ab44ac13055f4ab8569d2ff256", 0x1000}], 0x4, 0x25) 03:00:57 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x80ffff]}) [ 155.872416] binder_alloc: 13670: binder_alloc_buf, no vma [ 155.878095] binder: 13670:13673 transaction failed 29189/-3, size 24-8 line 2967 [ 155.887994] 9pnet: Could not find request transport: xen 03:00:57 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="025cc83d6d345f8f762070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = gettid() sched_getaffinity(r2, 0x8, &(0x7f0000000140)) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f00000000c0)="c4824da82b66ba2100b801000000efb9270900000f323640a7650f30c4e2899c8e02000000f02046452ef3440f6fb800f0ff7fc42101dbc40f2047"}], 0x0, 0x0, &(0x7f0000000080), 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000001e00fb034d564b0000000001"]) ioctl$KVM_ENABLE_CAP_CPU(r4, 0xc008ae88, &(0x7f00000001c0)={0x3, 0x0, [0x6e0]}) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:57 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 155.937513] 9pnet: Could not find request transport: xen [ 155.942164] binder: undelivered TRANSACTION_ERROR: 29189 [ 155.951312] binder: send failed reply for transaction 266, target dead 03:00:57 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe]}, r1}, 0x14) 03:00:57 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = dup2(r0, r0) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000280)={{{@in6=@ipv4={[], [], @rand_addr}, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@dev}}, &(0x7f0000000380)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000003c0)={{{@in6=@dev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@loopback}}, &(0x7f00000004c0)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000002940)={{{@in=@multicast2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@loopback}}, &(0x7f0000002a40)=0xe8) sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000002c40)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000002c00)={&(0x7f0000002a80)={0x15c, r2, 0x4, 0x70bd28, 0x25dfdbfb, {}, [{{0x8, 0x1, r3}, {0x84, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8, 0x3, 0xe}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x1f}}, {0x8, 0x6, r5}}}]}}, {{0x8, 0x1, r6}, {0xb4, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x2}}, {0x8, 0x7}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x7fff}}}]}}]}, 0x15c}, 0x1, 0x0, 0x0, 0x40050}, 0x20000000) ioctl(r0, 0x8912, &(0x7f0000000000)="025cde0000005f8f24762070000000000000000000000000000000259ac80678feb529740ff8d9b53a2ccef969dfd0af88b38dcc9f1f7769fb9cdcbbb74483fc594dd2cb0e94355a95a837ae8edb63e9918f0139cb77") r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r7, 0x40045431, &(0x7f00005befdc)) r8 = syz_open_pts(r7, 0x20201) ioctl$TCSETS(r8, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r8, &(0x7f0000000140), 0x28d) 03:00:57 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) getgroups(0x8, &(0x7f00000001c0)=[0xee00, 0xffffffffffffffff, 0xee00, 0xee01, 0x0, 0xee01, 0x0, 0xee01]) setresgid(r0, r1, r2) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:57 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x5451, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:57 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x365, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:57 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:57 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000]}) 03:00:57 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}, r1}, 0x14) [ 156.120903] binder: release 13736:13737 transaction 271 out, still active [ 156.128228] binder: unexpected work type, 4, not freed [ 156.133522] binder: undelivered TRANSACTION_COMPLETE [ 156.148254] binder_alloc: binder_alloc_mmap_handler: 13736 20001000-20004000 already mapped failed -16 03:00:57 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = accept$nfc_llcp(0xffffffffffffff9c, &(0x7f0000000000), &(0x7f00000000c0)=0x60) accept(r0, &(0x7f0000000100)=@nl=@unspec, &(0x7f0000000180)=0x80) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) timer_create(0x5, &(0x7f0000000340)={0x0, 0x0, 0x1, @thr={&(0x7f00000001c0)="edb4bc918f42cd8686b11717fa143c3ad52150d0bdca7ee08d2ef2ffcd1adbd748def78ba61f1ec2ada08d8d4b5c31ea0fa03af8facc77dbb813c28a060adb295c94504568b0b6b70d9e1a2523af5c88311a462845ff5932a0fc4a3f35d898b135585473a0fb95ecd7ea7bfeb7194c16130f6b229949d7b2415d98bc489975f812ea5007eb08146fbeb591cd81d136f6721b3e314f40f941a4e66c3bf14aab4a9bc43ffdbe81e8006a8987de25573ae4ecdda25c12e0f0885da64d3e5924fb5195e8347c0db6e8ba102eabb5d627f94c742887d5302b1a372dc17db46c", &(0x7f00000002c0)="5a6d2054955a8042e3ebb1303519da421249751ec92a72b46fccec9bf8066587418c2df24754bc9408efd3c4f50c0268dc5ff2d23398f42912c528aeece4929a396f"}}, &(0x7f0000000380)=0x0) timer_settime(r1, 0x1, &(0x7f00000003c0)={{0x0, 0x1c9c380}, {0x77359400}}, &(0x7f0000000400)) 03:00:57 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) open$dir(&(0x7f0000000000)='./file0\x00', 0x0, 0x20) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:57 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) r3 = socket$netlink(0x10, 0x3, 0x1f) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x1c, r4, 0x0, 0x70bd25, 0x25dfdbfd, {0xc}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r1, &(0x7f0000000100)="4d41223013086c564714fab3e16e38ce7b06512f889f2312880cf1525982bb4d5e8dc4fd20d6986b8ba834fdd87e4994bce4d25fa0a40791a3da4fa3880100000037a95ae08d8974971b1b80ec242daa245a48418a842a465399f6c19ff435b7a564cf329ca6b60810bfe5c0ffc7fbf105cdc81cc2455ada626ccc538f9a2fdf1dbf0a57b2e8c35f737989cd2873dba7d1d90516b42271b557591abbfbc3f08999556cf8199a69432e360915d9035c1959f382146a2f344ae9933b9396991edcfd982d3269d9491fac49d29f453bf8c563f6f8", 0xd3) openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x42000, 0x0) [ 156.174916] binder: BINDER_SET_CONTEXT_MGR already set 03:00:57 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xf6ffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:57 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:57 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000]}, r1}, 0x14) [ 156.210352] binder: 13736:13737 ioctl 40046207 0 returned -16 03:00:57 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000000000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:57 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:57 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x2082, 0x0) epoll_wait(r0, &(0x7f0000000040)=[{}], 0x1, 0x1) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) ioctl$GIO_UNISCRNMAP(r0, 0x4b69, &(0x7f00000001c0)=""/178) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:57 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}) 03:00:57 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xffd7, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:57 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x5452, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:57 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000]}, r1}, 0x14) 03:00:57 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) fstatfs(r1, &(0x7f00000000c0)=""/238) write(r2, &(0x7f0000000140), 0x28d) getsockopt(r0, 0x9, 0x0, &(0x7f0000000000)=""/17, &(0x7f0000000040)=0x11) [ 156.297604] binder_alloc: 13736: binder_alloc_buf, no vma [ 156.303252] binder: 13736:13786 transaction failed 29189/-3, size 24-8 line 2967 [ 156.322199] binder: undelivered TRANSACTION_ERROR: 29189 [ 156.340604] binder: send failed reply for transaction 271, target dead 03:00:57 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0xfffffffffffffc01, 0xe880) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000040)={0x6, [0x9, 0x8, 0x7, 0x8, 0x8, 0x9]}, &(0x7f00000000c0)=0x10) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000100)={0xffffffff}, 0x117, 0x1009}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000180)={0x7, 0x8, 0xfa00, {r1, 0x9}}, 0x10) 03:00:57 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x67) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x29ed12b9f15a34f8, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000500)=""/211, &(0x7f00000001c0)=0xd3) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000000)={0xffffffff}, 0x2, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r0, &(0x7f0000000140)={0xa, 0x1, 0xfa00, {r1}}, 0xc) 03:00:57 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x1000000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:57 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xc3d4}) write(r2, &(0x7f0000000140), 0x28d) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000002c0)=ANY=[@ANYBLOB="190a0000faa5ac3c30f55921925fd82f5a1f7f1367cf173f2544ceb6763b9b2b52557cc91c9b59f13191a2cdaa834a623312f219ae9a0d55fbe827091610a3761bec7a36bed33194635f0ba43430324ecdc18f85211655b4dff1e31ca14332ec3876d5e89c29e636ec91f1dfb4f817a5ffe08fc75640beb8d3ba718fa7019ca30b9a9e7a2cd6b40d1be1b2d4d2c84c984c3ce572e4b551bb20e207a84a7544fabb95cd2eabffe46d52885c2af33a3c9b3631b31f3d7e2556f45036436675c99c53b40ca4a092", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000000040)=0x14) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f00000000c0)=@assoc_id=r3, &(0x7f0000000100)=0x4) 03:00:57 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000]}, r1}, 0x14) 03:00:57 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:57 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]}) [ 156.435281] binder: release 13808:13811 transaction 276 out, still active [ 156.442303] binder: unexpected work type, 4, not freed [ 156.447636] binder: undelivered TRANSACTION_COMPLETE [ 156.457372] binder_alloc: binder_alloc_mmap_handler: 13808 20001000-20004000 already mapped failed -16 03:00:57 executing program 3 (fault-call:6 fault-nth:0): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1}) [ 156.564344] binder: BINDER_SET_CONTEXT_MGR already set [ 156.590679] binder: 13808:13811 ioctl 40046207 0 returned -16 [ 156.606282] binder_alloc: 13808: binder_alloc_buf, no vma 03:00:57 executing program 6: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/4\x00') setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000040)=0x25f, 0x4) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:57 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:57 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x1) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:00:57 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00]}, r1}, 0x14) 03:00:57 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x3000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 156.611903] binder: 13808:13819 transaction failed 29189/-3, size 24-8 line 2967 03:00:57 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x40046207, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:57 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000]}) 03:00:57 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 156.674773] binder: undelivered TRANSACTION_ERROR: 29189 [ 156.685472] binder: send failed reply for transaction 276, target dead 03:00:57 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:00:57 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80]}, r1}, 0x14) 03:00:57 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x339000, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r0, 0x40405514, &(0x7f00000000c0)={0x1, 0x7, 0x9, 0x101, '\x00', 0x101}) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) open$dir(&(0x7f0000000000)='./file0\x00', 0xfffc, 0x29) 03:00:57 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x18000) connect$bt_sco(r0, &(0x7f0000000080)={0x1f, {0x4, 0x4b, 0x1, 0x3, 0x81, 0xfd}}, 0x8) ioctl$BLKPG(r0, 0x1269, &(0x7f0000000200)={0x2, 0x92, 0xab, &(0x7f0000000140)="1ba2481ad542769a992adf32b19707f2a0dc5b46a82518ce565fdecb73f2f359326ecbf7420a658f908a6d4d4bf018140240b60e30b76e827746c5f522bfd1da16cd829d82dc556041bae622e472c170d002c11557c4f087a5311cd24b3d33a5eccf297f3500d7046d8e85c02391d6a7ac9eb73bf3a2704085c625dca3232ee24f208891282c085218fe7086feb0b8a067323f2c11325c8e2168fc540af00c17702d43fcbb998c2a4b2280"}) ioctl$FICLONE(r0, 0x40049409, r0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000000100)=0xb98, 0x8) ioctl$RTC_WIE_ON(r0, 0x700f) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000000)='./file0\x00') 03:00:57 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xad80000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 156.810266] binder: release 13887:13888 transaction 281 out, still active [ 156.817327] binder: unexpected work type, 4, not freed [ 156.822625] binder: undelivered TRANSACTION_COMPLETE [ 156.831818] binder: BINDER_SET_CONTEXT_MGR already set 03:00:57 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:57 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}) 03:00:58 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000]}, r1}, 0x14) 03:00:58 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2d2842, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x30}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000220002002abd7000ffdbdf25000000001e34bc7dd45729812b11a15e2ce2de5f262b63d2432a2193c00d44461b3538bfc58760880bbbfb38"], 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x40015) 03:00:58 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x0, 0x0) ioctl$RTC_PIE_ON(r0, 0x7005) getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$FICLONE(r0, 0x40049409, r0) prctl$setmm(0x23, 0x6, &(0x7f0000ffc000/0x4000)=nil) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) r1 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x8, 0x282000) setsockopt$inet6_MCAST_LEAVE_GROUP(r1, 0x29, 0x2d, &(0x7f00000002c0)={0x1f, {{0xa, 0x10000000004e26, 0xb2, @mcast1={0xff, 0x1, [], 0x1}, 0x3ff}}}, 0xfffffffffffffdec) pivot_root(&(0x7f0000000000)='./file0\x00', &(0x7f00000016c0)='./file0\x00') [ 156.860939] binder: 13887:13888 ioctl 40046207 20000080 returned -16 03:00:58 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x7d80000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:58 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0xae03, &(0x7f0000000040)={r3, 0x0, 0x1}) [ 156.915174] binder_alloc: binder_alloc_mmap_handler: 13887 20001000-20004000 already mapped failed -16 03:00:58 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000000)=@generic={0x3, 0x6, 0x5}) [ 156.987165] binder: BINDER_SET_CONTEXT_MGR already set [ 157.003697] binder: 13887:13888 ioctl 40046207 0 returned -16 [ 157.015283] binder_alloc: 13887: binder_alloc_buf, no vma [ 157.020994] binder: 13887:13909 transaction failed 29189/-3, size 24-8 line 2967 03:00:58 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x5460, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:58 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]}) 03:00:58 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80]}, r1}, 0x14) 03:00:58 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:58 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x900, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:58 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x1) pivot_root(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000100)=0x6) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:00:58 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4010ae67, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:00:58 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00009f3fa8)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003c1000)="0a0775b0d5e383e5b3b60ced5c54dbb7", 0x10) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000000000)=[{{&(0x7f0000000140)=@can={0x1d}, 0x80, &(0x7f0000000040)=[{&(0x7f00000006c0)="14", 0x1}], 0x1, &(0x7f0000003640)=ANY=[]}}], 0x1, 0x0) recvmsg(r1, &(0x7f0000003580)={&(0x7f00000003c0)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003440)=""/112, 0x200034b0}], 0x1, &(0x7f0000003500)=""/106, 0x6a}, 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) [ 157.056201] binder: BINDER_SET_CONTEXT_MGR already set [ 157.064217] binder: 13887:13943 ioctl 40046207 20000080 returned -16 [ 157.070887] binder: undelivered TRANSACTION_ERROR: 29189 [ 157.083978] binder: send failed reply for transaction 281, target dead 03:00:58 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00]}, r1}, 0x14) 03:00:58 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000]}) 03:00:58 executing program 0: r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000080)=0xe, 0x800) fcntl$addseals(r0, 0x409, 0x3) mkdir(&(0x7f0000000000)='./file0\x00', 0x126) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="07630452ac2e4e400000984eec9b"], 0x43, 0x0, &(0x7f0000000140)="ddb2d0b6dbd6c5ead70ca7fc44cb4532af2e929f761055c93c0c91468822971e7b63ccc513644d908ffd6ad1cbb1c792bf743f39944b712be072a9815ebe583d9525af"}) 03:00:58 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x600, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:58 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:58 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae46, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:00:58 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0xfff, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') [ 157.191663] binder: release 13970:13971 transaction 286 out, still active [ 157.198670] binder: unexpected work type, 4, not freed [ 157.203971] binder: undelivered TRANSACTION_COMPLETE [ 157.211973] binder_alloc: binder_alloc_mmap_handler: 13970 20001000-20004000 already mapped failed -16 [ 157.242133] binder: BINDER_SET_CONTEXT_MGR already set 03:00:58 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe]}, r1}, 0x14) [ 157.287236] binder: 13970:13971 ioctl 40046207 0 returned -16 [ 157.305304] binder_alloc: 13970: binder_alloc_buf, no vma [ 157.311054] binder: 13970:13973 transaction failed 29189/-3, size 24-8 line 2967 [ 157.321880] QAT: Invalid ioctl [ 157.334761] binder: undelivered TRANSACTION_ERROR: 29189 03:00:58 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0045878, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:58 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:58 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x9702, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:58 executing program 6: r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='qnx6\x00'}, 0x10) fcntl$setsig(r0, 0xa, 0x14) getsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000140)=0x70, &(0x7f00000001c0)=0x2) mkdir(&(0x7f0000000040)='\x00', 0x10) chroot(&(0x7f0000000280)='./file0\x00') ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x97) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000100)=0x400000000000, 0x4) 03:00:58 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000]}, r1}, 0x14) [ 157.365215] binder: send failed reply for transaction 286, target dead 03:00:58 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}) 03:00:58 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x10440, 0x0) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f00000000c0)=0x7) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000000000)='./file0/file0\x00', &(0x7f0000008ffb)='fuse.', 0x40000000000, &(0x7f0000009000)) 03:00:58 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0xc0189436, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:00:58 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 157.459219] binder: release 14025:14026 transaction 291 out, still active [ 157.466249] binder: unexpected work type, 4, not freed [ 157.471554] binder: undelivered TRANSACTION_COMPLETE [ 157.494547] binder_alloc: binder_alloc_mmap_handler: 14025 20001000-20004000 already mapped failed -16 03:00:58 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}, r1}, 0x14) 03:00:58 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xd802, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:58 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000400)='./file0\x00') mkdir(&(0x7f00000003c0)='./file0\x00', 0xc2) syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x7ef7, 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='bpf\x00', 0x1000, &(0x7f00000002c0)="348c5ed9a74316b1a9b1586074e217adfa72b429ed64c73b3e5a718b07369158f1bf9d9a4644f488bb1c529fecc506b21a30c1b4a74e9a72d5500aa07af8645a3146361966e8db27636980981761c413aba9e07dbf7f02be2fcea2a6696ae670c24754dae058eb937d47709d0f25e3ae3a6549aa3d6eb3445d9f2bbd5c44bbe064764874363bc754d2c0be35838bce894e170adf74f5ee096c610e531103cb52b339611cbafc38a5de94bbc9cc6183c21bbdd18146a58b74518bc5b7881d315a83dd3f020f89aa2251bc324c94ed84cc3a67bc545970633b22b3b1c5a724b9b55694016b73e477bdba4dfc92c6") pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') r0 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x9, 0x9458d97d5a8e01d8) recvmsg(r0, &(0x7f0000000280)={&(0x7f0000000100)=@ipx, 0x80, &(0x7f0000000240)=[{&(0x7f00000001c0)=""/80, 0x50}, {&(0x7f0000000500)=""/228, 0xe4}, {&(0x7f0000000600)=""/190, 0xbe}], 0x3, 0x0, 0x0, 0x3ff}, 0x0) 03:00:58 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x10200, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffff9c, 0x84, 0x18, &(0x7f0000000040)={0x0, 0x8}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000100)={0x0, 0x4, 0x8005, 0x4, 0x7f, 0xff, 0xa12d, 0x80000000, r1}, &(0x7f0000000140)=0x20) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000180)={0xffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000200)={0x15, 0x110, 0xfa00, {r2, 0x200, 0x0, 0x0, 0x0, @in={0x2, 0x4e22, @remote={0xac, 0x14, 0x14, 0xbb}}, @in={0x2, 0x4e21}}}, 0x118) [ 157.514983] binder_alloc: 14025: binder_alloc_buf, no vma [ 157.520698] binder: 14025:14035 transaction failed 29189/-3, size 24-8 line 2967 [ 157.527170] binder: BINDER_SET_CONTEXT_MGR already set 03:00:58 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]}) 03:00:58 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020aea5, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:00:58 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 157.588158] binder: undelivered TRANSACTION_ERROR: 29189 [ 157.684213] binder: 14025:14026 ioctl 40046207 0 returned -16 [ 157.695531] binder: send failed reply for transaction 291, target dead 03:00:58 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x4020940d, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:58 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000]}, r1}, 0x14) 03:00:58 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x1f00000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:58 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000]}) 03:00:58 executing program 0: r0 = syz_open_dev$sndpcmc(&(0x7f0000000180)='/dev/snd/pcmC#D#c\x00', 0x1, 0x4000) ioctl$VHOST_GET_VRING_BASE(r0, 0xc008af12, &(0x7f00000001c0)) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) sendto$unix(r0, &(0x7f0000000380)="816f66b1326dca6441efaf4b1538ede30c5d69c99fe45a021de29900ce58f6968085784c937c77dcb4a5f21f1860d9c6be7242e7e16c9d491721c79efcdc9c8f02a1c24a0687b49bbb039bc67ea40b7d9705d0f15bfb7f0a58dda2cc", 0x5c, 0x0, &(0x7f0000000400)=@file={0x1, './file0/file0\x00'}, 0x6e) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000340)) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ip_vs_stats\x00') getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000040)={0x0, 0x7fff, 0x3ab, 0x8001, 0x1, 0x9ccf, 0x100000001, 0x4, {0x0, @in={{0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}}, 0x7, 0x80000001, 0x20, 0x5, 0x2}}, &(0x7f0000000100)=0xb0) mount$9p_tcp(&(0x7f0000000200)='127.0.0.1\x00', &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x20000, &(0x7f00000002c0)={'trans=tcp,', {'port', 0x3d, 0x4e24}, 0x2c, {[{@mmap='mmap', 0x2c}, {@version_L='version=9p2000.L', 0x2c}, {@uname={'uname', 0x3d, 'net/ip_vs_stats\x00'}, 0x2c}, {@noextend='noextend', 0x2c}, {@loose='loose', 0x2c}]}}) setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000140)={r2, 0x7f}, 0x8) 03:00:58 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200200, 0x0) ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f00000002c0)=""/252) 03:00:58 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x5452, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:00:58 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 157.742058] device bridge_slave_1 left promiscuous mode [ 157.747582] bridge0: port 2(bridge_slave_1) entered disabled state [ 157.762608] device bridge_slave_0 left promiscuous mode [ 157.768122] bridge0: port 1(bridge_slave_0) entered disabled state 03:00:58 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:58 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f00000001c0)) listxattr(&(0x7f0000000000)='./file0/file0\x00', &(0x7f00000000c0)=""/202, 0xca) 03:00:58 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xffd70000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:59 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x2, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:00:59 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}) 03:00:59 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x1f00, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:59 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:00:59 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) statfs(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/128) mkdir(&(0x7f0000000000)='./file0\x00', 0x8) [ 157.937340] team0 (unregistering): Port device team_slave_1 removed [ 157.968402] team0 (unregistering): Port device team_slave_0 removed [ 158.034179] IPVS: ftp: loaded support on port[0] = 21 [ 158.044350] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 158.073781] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 158.106948] bond0 (unregistering): Released all slaves [ 158.124177] binder: release 14096:14097 transaction 296 out, still active [ 158.131202] binder: unexpected work type, 4, not freed [ 158.136495] binder: undelivered TRANSACTION_COMPLETE [ 158.144684] binder_alloc: binder_alloc_mmap_handler: 14096 20001000-20004000 already mapped failed -16 03:00:59 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x40046208, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:00:59 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]}) 03:00:59 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020940d, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:00:59 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xfed70000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:00:59 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 158.163539] binder: BINDER_SET_CONTEXT_MGR already set [ 158.168911] binder_alloc: 14096: binder_alloc_buf, no vma [ 158.170400] binder: 14096:14097 ioctl 40046207 0 returned -16 [ 158.174555] binder: 14096:14139 transaction failed 29189/-3, size 24-8 line 2967 [ 158.190359] binder: undelivered TRANSACTION_ERROR: 29189 [ 158.201464] binder: send failed reply for transaction 296, target dead [ 158.241780] binder: release 14146:14151 transaction 301 out, still active [ 158.245365] binder_alloc: binder_alloc_mmap_handler: 14146 20001000-20004000 already mapped failed -16 [ 158.248817] binder: unexpected work type, 4, not freed [ 158.263628] binder: undelivered TRANSACTION_COMPLETE [ 158.330294] binder: BINDER_SET_CONTEXT_MGR already set [ 158.344582] binder: 14146:14151 ioctl 40046207 0 returned -16 [ 158.356140] binder_alloc: 14146: binder_alloc_buf, no vma [ 158.361764] binder: 14146:14156 transaction failed 29189/-3, size 24-8 line 2967 [ 158.383515] binder: undelivered TRANSACTION_ERROR: 29189 [ 158.394316] binder: send failed reply for transaction 301, target dead [ 158.703317] bridge0: port 1(bridge_slave_0) entered blocking state [ 158.709717] bridge0: port 1(bridge_slave_0) entered disabled state [ 158.716727] device bridge_slave_0 entered promiscuous mode [ 158.739297] bridge0: port 2(bridge_slave_1) entered blocking state [ 158.745658] bridge0: port 2(bridge_slave_1) entered disabled state [ 158.752628] device bridge_slave_1 entered promiscuous mode [ 158.779881] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 158.802476] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 158.856309] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 158.878584] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 158.960724] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 158.967765] team0: Port device team_slave_0 added [ 158.987269] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 158.994436] team0: Port device team_slave_1 added [ 159.013855] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 159.036106] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 159.058211] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 159.080332] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 159.246819] bridge0: port 2(bridge_slave_1) entered blocking state [ 159.253190] bridge0: port 2(bridge_slave_1) entered forwarding state [ 159.259790] bridge0: port 1(bridge_slave_0) entered blocking state [ 159.266219] bridge0: port 1(bridge_slave_0) entered forwarding state [ 159.866892] 8021q: adding VLAN 0 to HW filter on device bond0 [ 159.926782] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 159.985852] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 159.992149] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 159.999144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 160.056968] 8021q: adding VLAN 0 to HW filter on device team0 03:01:01 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:01 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:01:01 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe]}, r1}, 0x14) 03:01:01 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0xae41, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:01:01 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]}) 03:01:01 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xd7fc, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:01 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0046209, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:01 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/conn_reuse_mode\x00', 0x2, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000080)) mkdir(&(0x7f0000000040)='./file0\x00', 0xa8) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000000)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:01:01 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000]}, r1}, 0x14) 03:01:01 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 160.446616] binder: release 14426:14433 transaction 306 out, still active [ 160.453718] binder: unexpected work type, 4, not freed [ 160.459029] binder: undelivered TRANSACTION_COMPLETE [ 160.471056] binder_alloc: binder_alloc_mmap_handler: 14426 20001000-20004000 already mapped failed -16 03:01:01 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x3ff, 0x4400) execveat(r0, &(0x7f0000000300)='./file0/file0\x00', &(0x7f00000001c0)=[&(0x7f00000000c0)='mime_type+%}\x00', &(0x7f0000000340)='\x00', &(0x7f0000000140)='vboxnet0\x00', &(0x7f0000000180)='fuse.'], &(0x7f00000002c0)=[&(0x7f0000000200)='fuse.', &(0x7f0000000240)='fuse.', &(0x7f0000000280)='-md5sum\x00'], 0x800) 03:01:01 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x2d8000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 160.499711] binder: BINDER_SET_CONTEXT_MGR already set 03:01:01 executing program 6: bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', 0x0, 0x8}, 0x10) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000040)='./file0\x00', 0x8) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:01:01 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x5460, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:01:01 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000]}) [ 160.535112] binder: 14426:14433 ioctl 40046207 0 returned -16 03:01:01 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}, r1}, 0x14) 03:01:01 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xfcd7000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:01 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:01 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x2001, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r0, 0x4008ae93, &(0x7f0000000040)=0x5000) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f00000000c0)={'ip6_vti0\x00', 0x2}) 03:01:01 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind(r0, &(0x7f0000000080)=@nfc={0x27, 0x1, 0x1, 0x5}, 0x80) pivot_root(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000040)='./file0\x00') [ 160.620593] binder_alloc: 14426: binder_alloc_buf, no vma [ 160.626254] binder: 14426:14471 transaction failed 29189/-3, size 24-8 line 2967 03:01:01 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000]}, r1}, 0x14) 03:01:01 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:01 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc018620b, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:01 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4008ae6a, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:01:01 executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x2) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x430080, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffff9c, 0x84, 0x1d, &(0x7f0000000080)={0x2, [0x0, 0x0]}, &(0x7f00000000c0)=0xc) getsockname$llc(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000100)={r1, 0x48649d32}, &(0x7f0000000140)=0x8) link(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='./file0/file0\x00') 03:01:01 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x40c0, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:01:01 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x65030000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 160.715241] binder: send failed reply for transaction 306, target dead [ 160.738350] binder: undelivered TRANSACTION_ERROR: 29189 03:01:01 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}) 03:01:01 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000]}, r1}, 0x14) 03:01:02 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000140)=0x0) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000080)=r1) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:01:02 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) get_thread_area(&(0x7f0000000000)={0x5a, 0x20001000, 0xffffffff, 0x9, 0xffffffffffffffff, 0x3, 0x5, 0x3, 0x5, 0x9}) mount(&(0x7f0000005000)='./file0/file0\x00', &(0x7f0000009ff8)='./file0\x00', &(0x7f0000008ffb)='fuse.', 0x0, &(0x7f0000009000)) 03:01:02 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 160.835627] binder: release 14506:14509 transaction 311 out, still active [ 160.842648] binder: unexpected work type, 4, not freed [ 160.847978] binder: undelivered TRANSACTION_COMPLETE [ 160.863709] binder_alloc: binder_alloc_mmap_handler: 14506 20001000-20004000 already mapped failed -16 03:01:02 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x4000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:02 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0xc020660b, &(0x7f0000000040)={r3, 0x0, 0x1}) [ 160.931387] binder: BINDER_SET_CONTEXT_MGR already set 03:01:02 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00]}, r1}, 0x14) 03:01:02 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000]}) 03:01:02 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:02 executing program 0: [ 160.973082] binder: 14506:14509 ioctl 40046207 0 returned -16 [ 161.003536] binder_alloc: 14506: binder_alloc_buf, no vma [ 161.009369] binder: 14506:14522 transaction failed 29189/-3, size 24-8 line 2967 [ 161.063932] binder: undelivered TRANSACTION_ERROR: 29189 [ 161.071857] binder: send failed reply for transaction 311, target dead 03:01:02 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0189436, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:02 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='befs\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:01:02 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xfed7, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:02 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4008ae61, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:01:02 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80]}, r1}, 0x14) 03:01:02 executing program 0: 03:01:02 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:02 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}) 03:01:02 executing program 0: 03:01:02 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xe, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:02 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x105081, 0x0) getpeername$unix(r0, &(0x7f0000000040), &(0x7f0000000100)=0x6e) 03:01:02 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x5421, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:01:02 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:02 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00]}, r1}, 0x14) [ 161.219125] binder: release 14585:14589 transaction 316 out, still active [ 161.226138] binder: unexpected work type, 4, not freed [ 161.231476] binder: undelivered TRANSACTION_COMPLETE [ 161.242234] binder_alloc: binder_alloc_mmap_handler: 14585 20001000-20004000 already mapped failed -16 03:01:02 executing program 0: 03:01:02 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]}) [ 161.296144] binder_alloc: 14585: binder_alloc_buf, no vma [ 161.301785] binder: 14585:14597 transaction failed 29189/-3, size 24-8 line 2967 [ 161.306354] binder: BINDER_SET_CONTEXT_MGR already set [ 161.360008] binder: undelivered TRANSACTION_ERROR: 29189 03:01:02 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0045877, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:02 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x4000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:02 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) utime(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={0x8, 0x8}) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:01:02 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="1214", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:02 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80]}, r1}, 0x14) 03:01:02 executing program 0: 03:01:02 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x5450, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:01:02 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000]}) [ 161.417636] binder: 14585:14589 ioctl 40046207 0 returned -16 [ 161.429887] binder: send failed reply for transaction 316, target dead 03:01:02 executing program 0: 03:01:02 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x300000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:02 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6716", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:02 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe]}, r1}, 0x14) 03:01:02 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1002, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:01:02 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x5451, &(0x7f0000000040)={r3, 0x0, 0x1}) [ 161.528511] binder: release 14649:14652 transaction 321 out, still active [ 161.535512] binder: unexpected work type, 4, not freed [ 161.540808] binder: undelivered TRANSACTION_COMPLETE [ 161.548585] binder_alloc: binder_alloc_mmap_handler: 14649 20001000-20004000 already mapped failed -16 03:01:02 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}) 03:01:02 executing program 0: [ 161.617746] binder: BINDER_SET_CONTEXT_MGR already set [ 161.660913] binder: 14649:14652 ioctl 40046207 0 returned -16 [ 161.695146] binder_alloc: 14649: binder_alloc_buf, no vma [ 161.700813] binder: 14649:14660 transaction failed 29189/-3, size 24-8 line 2967 03:01:02 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x5421, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:02 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000]}, r1}, 0x14) 03:01:02 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="670e", 0x2}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:02 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0xc0045878, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:01:02 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x400) write$P9_RATTACH(r0, &(0x7f0000000040)={0x14, 0x69, 0x1, {0x40, 0x4, 0x7}}, 0x14) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:01:02 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xd80000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:02 executing program 0: 03:01:02 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]}) [ 161.711625] binder: undelivered TRANSACTION_ERROR: 29189 [ 161.737471] binder: send failed reply for transaction 321, target dead 03:01:02 executing program 0: 03:01:02 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x7ffff000}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:02 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}, r1}, 0x14) 03:01:02 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x5, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:02 executing program 6: r0 = memfd_create(&(0x7f0000000180)='cpusetsystemsecurity\x00', 0x1) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffff9c, 0x84, 0x71, &(0x7f0000000640)={0x0, 0x3}, &(0x7f0000000680)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f00000006c0)={0x4, 0x0, 0x800, 0xa93b, r1}, 0x10) r2 = syz_open_dev$adsp(&(0x7f0000000340)='/dev/adsp#\x00', 0x4, 0x150fff) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000000c0)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f00000005c0)={r1, 0x5}, &(0x7f00000008c0)=0x8) mkdir(&(0x7f0000000040)='./file0\x00', 0x46) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000840)=ANY=[@ANYRES32=0x0, @ANYBLOB="a8a8321b5318766cce3f38be7a3d5c4f3122eace5714c5db3f8b16f80cb469b8a1e6753d15851b14a2e682bf86fcfa3d9bf236757993ac0edd35ebea3c50f60000000000"], &(0x7f00000003c0)=0xa) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r2, 0x84, 0x19, &(0x7f0000000400)={r3}, 0x8) symlink(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='./file0/file0\x00') mkdir(&(0x7f0000000380)='./file0/file0\x00', 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6) mount$bpf(0x0, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580)='bpf\x00', 0x2000, &(0x7f0000000700)=ANY=[@ANYBLOB="6d6f64653d3335fb6d6f64653d372c000d22d4a47604f3e341a5f1acd9e6cd0200c686d79a180037ff20e8a1bd0c3845019b1727a328b6268b7c781ba3ff5a76664a9375953f79ff45ea958a5324fa0996689a4d551727b183958d89858e9b759fbbc2eb0effd816f9c49a76f3e478dce6ee9cef4fec26b97662adb71a315fb600000000f4f462584e4814296de1c807ffbcae833247464b01e582ff8d1cc5e25e62455378cf1f4c16abf3f7990d52aa6135740000000000a409505e58521a1119dad6d60f3fc996e969081b3305b815a6631c3f1eb032220b20fc207f295f06af95e4f1a815bc038ff989165825ab1cf8dbf60f920fa81eb8647e71834bc13753bc2bdcc60cf8ed65839e91f4416d10a945324d700d9ec870d6d80000"]) chroot(&(0x7f0000000280)='./file0\x00') getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f00000001c0)={0x0, 0xb4, 0x9, 0x7fffffff, 0xb6, 0x6, 0x6, 0xff, {0x0, @in={{0x2, 0x4e24, @remote={0xac, 0x14, 0x14, 0xbb}}}, 0x1, 0x1ff, 0x6, 0x1, 0xffffffffffffff00}}, &(0x7f0000000080)=0xb0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000100)={r4, 0x81}, &(0x7f0000000140)=0x8) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000500)) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000600)='/proc/self/net/pfkey\x00', 0x400000, 0x0) r5 = semget(0x0, 0x1, 0xe0) semctl$SETVAL(r5, 0x4, 0x10, &(0x7f0000000000)=0x2) 03:01:03 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4040ae79, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:01:03 executing program 0: [ 161.865353] binder: release 14719:14720 transaction 326 out, still active [ 161.872454] binder: unexpected work type, 4, not freed [ 161.877791] binder: undelivered TRANSACTION_COMPLETE [ 161.895644] binder_alloc: binder_alloc_mmap_handler: 14719 20001000-20004000 already mapped failed -16 03:01:03 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]}) [ 161.963139] binder: BINDER_SET_CONTEXT_MGR already set [ 162.002591] binder: 14719:14720 ioctl 40046207 0 returned -16 [ 162.016667] binder_alloc: 14719: binder_alloc_buf, no vma [ 162.022366] binder: 14719:14723 transaction failed 29189/-3, size 24-8 line 2967 [ 162.054317] binder: undelivered TRANSACTION_ERROR: 29189 03:01:03 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x40046205, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:03 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000]}, r1}, 0x14) 03:01:03 executing program 6: mkdir(&(0x7f0000000000)='./file0\x00', 0x10) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:01:03 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x4}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:03 executing program 0: 03:01:03 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x40049409, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:01:03 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x4300000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:03 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000]}) [ 162.064606] binder: send failed reply for transaction 326, target dead 03:01:03 executing program 0: 03:01:03 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0xc}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:03 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000]}, r1}, 0x14) 03:01:03 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x400000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:03 executing program 6: r0 = msgget$private(0x0, 0x440) r1 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffff9c) fstat(0xffffffffffffff9c, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = getgid() fchmod(r1, 0xa4) fchownat(r1, &(0x7f0000000080)='./file0\x00', r2, r3, 0x800) msgctl$IPC_RMID(r0, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000280)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x30000, 0x0) timer_create(0x7, &(0x7f00000001c0)={0x0, 0x35, 0x4, @tid=0xffffffffffffffff}, &(0x7f0000000200)=0x0) timer_delete(r5) fchmodat(r4, &(0x7f0000000040)='./file0\x00', 0x4) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') 03:01:03 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}) 03:01:03 executing program 0: [ 162.154491] binder: release 14780:14781 transaction 331 out, still active [ 162.161596] binder: unexpected work type, 4, not freed [ 162.166907] binder: undelivered TRANSACTION_COMPLETE [ 162.175074] binder_alloc: binder_alloc_mmap_handler: 14780 20001000-20004000 already mapped failed -16 03:01:03 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0xc0045877, &(0x7f0000000040)={r3, 0x0, 0x1}) [ 162.248071] binder: BINDER_SET_CONTEXT_MGR already set [ 162.293098] binder: 14780:14781 ioctl 40046207 0 returned -16 [ 162.344259] binder_alloc: 14780: binder_alloc_buf, no vma [ 162.349922] binder: 14780:14783 transaction failed 29189/-3, size 24-8 line 2967 [ 162.377446] binder: undelivered TRANSACTION_ERROR: 29189 03:01:03 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x2, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:03 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x301}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:03 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe]}, r1}, 0x14) 03:01:03 executing program 0: 03:01:03 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x9b7c4bef00000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:03 executing program 6: futex(&(0x7f0000000ffc), 0x85, 0x0, &(0x7f0000586ff8), &(0x7f00000acffd), 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chroot(&(0x7f0000000140)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x22000, 0x0) write$P9_RWRITE(r0, &(0x7f0000000100)={0xb, 0x77, 0x3, 0x22e7c0}, 0xb) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='qnx6\x00', 0x1000, &(0x7f0000000500)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000016c0)='./file0\x00') getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@dev, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@local}}, &(0x7f0000000040)=0xe8) name_to_handle_at(r0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x4b, 0x0, "177c622eff64b9e354c3a0cad38c42035bdbc6c9747b0f4308fabd37727afc6642af1a049383fa2232fd590b15e740a3254ab60b48bb65eaf818cb01d3633037399a70"}, &(0x7f0000000280), 0x1400) r2 = getgid() syz_fuse_mount(&(0x7f0000000000)='./file0\x00', 0xa000, r1, r2, 0xffffffffffffffc0, 0x1200040) 03:01:03 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000]}) 03:01:03 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0xc00caee0, &(0x7f0000000040)={r3, 0x0, 0x1}) [ 162.391103] binder: send failed reply for transaction 331, target dead 03:01:03 executing program 0: 03:01:03 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0xa}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:03 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000]}, r1}, 0x14) 03:01:03 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xd806, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:03 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}) 03:01:03 executing program 6: 03:01:03 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4010ae42, &(0x7f0000000040)={r3, 0x0, 0x1}) [ 162.483309] binder: release 14838:14841 transaction 336 out, still active [ 162.490357] binder: unexpected work type, 4, not freed [ 162.495653] binder: undelivered TRANSACTION_COMPLETE [ 162.505969] binder_alloc: binder_alloc_mmap_handler: 14838 20001000-20004000 already mapped failed -16 03:01:03 executing program 0 (fault-call:4 fault-nth:0): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)) [ 162.581486] binder: BINDER_SET_CONTEXT_MGR already set [ 162.609579] binder_alloc: 14838: binder_alloc_buf, no vma [ 162.615212] binder: 14838:14845 transaction failed 29189/-3, size 24-8 line 2967 [ 162.619129] binder: 14838:14841 ioctl 40046207 0 returned -16 03:01:03 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x40049409, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:03 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}, r1}, 0x14) 03:01:03 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x20000442}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:03 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x2b4, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:03 executing program 6 (fault-call:3 fault-nth:0): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x0, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:03 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4010ae68, &(0x7f0000000040)={r3, 0x0, 0x1}) 03:01:03 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)) 03:01:03 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]}) [ 162.689296] binder: undelivered TRANSACTION_ERROR: 29189 [ 162.697426] binder: send failed reply for transaction 336, target dead [ 162.754566] FAULT_INJECTION: forcing a failure. [ 162.754566] name failslab, interval 1, probability 0, space 0, times 0 [ 162.765861] CPU: 0 PID: 14895 Comm: syz-executor6 Not tainted 4.18.0-rc3-next-20180706+ #1 [ 162.774264] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 162.783618] Call Trace: [ 162.786230] dump_stack+0x1c9/0x2b4 [ 162.788765] binder: release 14900:14901 transaction 341 out, still active [ 162.790452] ? dump_stack_print_info.cold.2+0x52/0x52 03:01:03 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x1a000}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:03 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xd807, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 162.790478] should_fail.cold.4+0xa/0x11 [ 162.790497] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 162.797455] binder: unexpected work type, 4, not freed [ 162.802623] ? lock_repin_lock+0x430/0x430 [ 162.802647] ? kasan_check_write+0x14/0x20 [ 162.806677] binder: undelivered TRANSACTION_COMPLETE [ 162.811760] ? __schedule+0x884/0x1ed0 [ 162.811776] ? _raw_spin_unlock+0x22/0x30 [ 162.817462] irq bypass consumer (token 00000000135074f2) registration fails: -16 [ 162.821250] ? lock_acquire+0x1e4/0x540 [ 162.821263] ? fs_reclaim_acquire+0x20/0x20 [ 162.821281] ? lock_downgrade+0x8f0/0x8f0 [ 162.834266] binder_alloc: binder_alloc_mmap_handler: 14900 20001000-20004000 already mapped failed -16 [ 162.834451] ? check_same_owner+0x340/0x340 [ 162.859345] irq bypass consumer (token 000000001f3b2324) registration fails: -16 [ 162.867955] ? do_raw_spin_unlock+0xa7/0x2f0 [ 162.867970] ? rcu_note_context_switch+0x730/0x730 [ 162.867986] __should_failslab+0x124/0x180 [ 162.868006] should_failslab+0x9/0x14 [ 162.874925] binder: BINDER_SET_CONTEXT_MGR already set [ 162.879836] __kmalloc+0x2c8/0x760 [ 162.879853] ? wait_for_completion+0xee/0x8d0 [ 162.879866] ? crypto_alg_extsize+0x80/0x80 [ 162.879885] ? wait_for_completion_interruptible+0x950/0x950 [ 162.920523] ? sock_kmalloc+0x156/0x1f0 [ 162.924502] ? queue_work_on+0x12c/0x1e0 [ 162.928575] sock_kmalloc+0x156/0x1f0 [ 162.931691] binder_alloc: 14900: binder_alloc_buf, no vma [ 162.932377] ? __sk_mem_schedule+0xe0/0xe0 [ 162.932399] ? kasan_check_write+0x14/0x20 [ 162.938644] binder: 14900:14905 transaction failed 29189/-3, size 24-8 line 2967 [ 162.942799] ? lock_sock_nested+0x9f/0x120 [ 162.942814] ? trace_hardirqs_on+0xd/0x10 [ 162.942836] hash_alloc_result.part.4+0x99/0x120 [ 162.954060] binder: 14900:14901 ioctl 40046207 0 returned -16 [ 162.954572] hash_sendmsg+0x903/0xac0 [ 162.959445] binder: undelivered TRANSACTION_ERROR: 29189 [ 162.962930] ? move_addr_to_kernel.part.20+0x100/0x100 [ 162.962950] ? hash_recvmsg+0xa60/0xa60 [ 162.962963] sock_sendmsg+0xd5/0x120 [ 162.962979] ___sys_sendmsg+0x51d/0x930 [ 162.999639] ? __check_object_size+0x9d/0x5f2 [ 163.004129] ? copy_msghdr_from_user+0x580/0x580 [ 163.008873] ? lock_acquire+0x1e4/0x540 [ 163.012833] ? lock_downgrade+0x8f0/0x8f0 [ 163.016969] ? __fget_light+0x2f7/0x440 [ 163.020928] ? fget_raw+0x20/0x20 [ 163.024371] ? vmf_insert_mixed_mkwrite+0xa0/0xa0 [ 163.029199] ? __f_unlock_pos+0x19/0x20 [ 163.033161] ? lock_downgrade+0x8f0/0x8f0 [ 163.037301] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 163.042821] ? proc_fail_nth_write+0x9e/0x210 [ 163.047305] ? proc_cwd_link+0x1d0/0x1d0 [ 163.051366] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 163.056890] ? sockfd_lookup_light+0xc5/0x160 [ 163.061389] __sys_sendmmsg+0x240/0x6f0 [ 163.065355] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 163.069661] ? fsnotify_first_mark+0x350/0x350 [ 163.074228] ? __fsnotify_parent+0xcc/0x420 [ 163.078547] ? fsnotify+0x14e0/0x14e0 [ 163.082346] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 163.087869] ? fput+0x130/0x1a0 [ 163.091134] ? ksys_write+0x1ae/0x260 [ 163.094932] ? __ia32_sys_read+0xb0/0xb0 [ 163.098987] __x64_sys_sendmmsg+0x9d/0x100 [ 163.103213] do_syscall_64+0x1b9/0x820 [ 163.107088] ? syscall_slow_exit_work+0x500/0x500 [ 163.111919] ? syscall_return_slowpath+0x5e0/0x5e0 [ 163.116833] ? syscall_return_slowpath+0x31d/0x5e0 [ 163.121759] ? prepare_exit_to_usermode+0x291/0x3b0 [ 163.126760] ? perf_trace_sys_enter+0xb10/0xb10 [ 163.131414] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 163.136245] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 163.141417] RIP: 0033:0x455e29 [ 163.144588] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 163.163855] RSP: 002b:00007fcc6cad8c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 163.171550] RAX: ffffffffffffffda RBX: 00007fcc6cad96d4 RCX: 0000000000455e29 [ 163.178808] RDX: 0000000000001500 RSI: 0000000020002940 RDI: 0000000000000014 [ 163.186061] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 163.193314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000015 03:01:04 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000]}, r1}, 0x14) 03:01:04 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0xffeb}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:04 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0xc008ae67, &(0x7f0000000040)={r3, 0x0, 0x1}) [ 163.200565] R13: 00000000004c1125 R14: 00000000004d1570 R15: 0000000000000000 03:01:04 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x5450, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) [ 163.238771] binder: send failed reply for transaction 341, target dead 03:01:04 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x2, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:04 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x7}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:04 executing program 6 (fault-call:3 fault-nth:1): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x0, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:04 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000]}) 03:01:04 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000]}, r1}, 0x14) 03:01:04 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0xffff8000, 0x1}) 03:01:04 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0xfffffdef}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) [ 163.375183] binder: release 14935:14936 transaction 346 out, still active [ 163.382206] binder: unexpected work type, 4, not freed [ 163.387575] binder: undelivered TRANSACTION_COMPLETE [ 163.398423] binder_alloc: binder_alloc_mmap_handler: 14935 20001000-20004000 already mapped failed -16 03:01:04 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xfdffffff00000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:04 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)) 03:01:04 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80]}, r1}, 0x14) 03:01:04 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0xfffffdfd, 0x1}) 03:01:04 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}) [ 163.495440] binder: BINDER_SET_CONTEXT_MGR already set [ 163.500834] binder_alloc: 14935: binder_alloc_buf, no vma [ 163.506462] binder: 14935:14949 transaction failed 29189/-3, size 24-8 line 2967 [ 163.527982] binder: 14935:14936 ioctl 40046207 0 returned -16 03:01:04 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x9}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:04 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00]}, r1}, 0x14) 03:01:04 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x6402000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 163.672623] binder: undelivered TRANSACTION_ERROR: 29189 [ 163.684332] binder: send failed reply for transaction 346, target dead 03:01:04 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x3, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:04 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x80ffff00000000, 0x1}) 03:01:04 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x0, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:04 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000]}, r1}, 0x14) 03:01:04 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x5b4}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:04 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x97ffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:04 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]}) 03:01:04 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000]}, r1}, 0x14) [ 163.813788] binder: release 15006:15009 transaction 351 out, still active [ 163.820808] binder: unexpected work type, 4, not freed [ 163.826133] binder: undelivered TRANSACTION_COMPLETE [ 163.831550] binder: 15006:15009 unknown command 320 [ 163.850081] binder: 15006:15009 ioctl c0306201 20000080 returned -22 03:01:04 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x2f, &(0x7f00000001c0)}], 0x1, 0x0) [ 163.865944] binder_alloc: binder_alloc_mmap_handler: 15006 20001000-20004000 already mapped failed -16 [ 163.930921] binder: BINDER_SET_CONTEXT_MGR already set [ 163.968254] binder: 15006:15009 ioctl 40046207 0 returned -16 [ 163.982124] binder_alloc: 15006: binder_alloc_buf, no vma [ 163.987769] binder: 15006:15025 transaction failed 29189/-3, size 24-8 line 2967 [ 164.011184] binder: 15006:15038 unknown command 320 [ 164.022807] binder: 15006:15038 ioctl c0306201 20000080 returned -22 [ 164.037556] binder: undelivered TRANSACTION_ERROR: 29189 [ 164.046109] binder: send failed reply for transaction 351, target dead 03:01:05 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5415, &(0x7f0000000040)) 03:01:05 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000]}) 03:01:05 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x1000000000000, 0x1}) 03:01:05 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x8d80000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:05 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00]}, r1}, 0x14) 03:01:05 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x32, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:05 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0xffffff7f00000000, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:05 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0xfffffdfd, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) [ 164.148343] binder: release 15045:15046 transaction 356 out, still active [ 164.155357] binder: unexpected work type, 4, not freed [ 164.160654] binder: undelivered TRANSACTION_COMPLETE [ 164.170706] binder_alloc: binder_alloc_mmap_handler: 15045 20001000-20004000 already mapped failed -16 03:01:05 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x33, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:05 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80]}, r1}, 0x14) [ 164.200609] binder: BINDER_SET_CONTEXT_MGR already set 03:01:05 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0xfdfdffff00000000, 0x1}) 03:01:05 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x500, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:05 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}) [ 164.224436] binder: 15045:15046 ioctl 40046207 0 returned -16 03:01:05 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0xff03000000000000, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:05 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5441, &(0x7f0000000040)) 03:01:05 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x9, &(0x7f00000001c0)}], 0x1, 0x0) [ 164.266134] binder_alloc: 15045: binder_alloc_buf, no vma [ 164.271780] binder: 15045:15073 transaction failed 29189/-3, size 24-8 line 2967 03:01:05 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe]}, r1}, 0x14) [ 164.375761] binder: undelivered TRANSACTION_ERROR: 29189 [ 164.381835] binder: send failed reply for transaction 356, target dead 03:01:05 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xfdd7, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:05 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0xffffff88, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:05 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x545d, &(0x7f0000000040)) 03:01:05 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x0, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]}) 03:01:05 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000]}, r1}, 0x14) 03:01:05 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0xeffdffff00000000, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:05 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0xfdfdffff00000000, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:05 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x80ffff, 0x1}) 03:01:05 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xad8000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:05 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x8, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:05 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}, r1}, 0x14) 03:01:05 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x2, &(0x7f0000000040)) 03:01:05 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000fe1fe4)={0x6, 0x4, 0x84, 0xf}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000000)={r4, &(0x7f0000000040), &(0x7f0000c3dfc6), 0x3}, 0x20) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) [ 164.603529] binder: release 15135:15138 transaction 361 out, still active [ 164.610538] binder: unexpected work type, 4, not freed [ 164.615866] binder: undelivered TRANSACTION_COMPLETE [ 164.628895] binder_alloc: binder_alloc_mmap_handler: 15135 20001000-20004000 already mapped failed -16 [ 164.660176] binder: BINDER_SET_CONTEXT_MGR already set 03:01:05 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x9702000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:05 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0xffffff84, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:05 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x3) 03:01:05 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x2, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:05 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5460, &(0x7f0000000040)) [ 164.695109] binder: 15135:15138 ioctl 40046207 0 returned -16 [ 164.719859] binder_alloc: 15135: binder_alloc_buf, no vma [ 164.725536] binder: 15135:15146 transaction failed 29189/-3, size 24-8 line 2967 03:01:05 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0xfdfdffff, 0x1}) 03:01:05 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x100000000000000, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) [ 164.791144] binder: undelivered TRANSACTION_ERROR: 29189 [ 164.802559] binder: send failed reply for transaction 361, target dead 03:01:05 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x3f000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:05 executing program 5: socket$netlink(0x10, 0x3, 0xf) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) r4 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0xfffffffffffffde2, 0x800) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f00000001c0)={0x0, 0x1, 0x1f4, 0x3, 0xd5, 0x2, 0x5, 0x3, {0x0, @in6={{0xa, 0x4e24, 0x401, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0xe794}}, 0xb5c, 0x5, 0x8, 0x40, 0x1}}, &(0x7f0000000100)=0xb0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r4, 0x84, 0xf, &(0x7f0000000280)={r5, @in={{0x2, 0x4e21, @loopback=0x7f000001}}, 0x8, 0x1, 0x6, 0x2, 0x4}, &(0x7f0000000140)=0x98) 03:01:06 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x6, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:06 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x13) 03:01:06 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x80045440, &(0x7f0000000040)) 03:01:06 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1400}) [ 164.915281] binder: release 15191:15195 transaction 366 out, still active [ 164.922292] binder: unexpected work type, 4, not freed [ 164.927631] binder: undelivered TRANSACTION_COMPLETE [ 164.944251] binder_alloc: binder_alloc_mmap_handler: 15191 20001000-20004000 already mapped failed -16 03:01:06 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x20000214) 03:01:06 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1300, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:06 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x5d80000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 164.980747] irq bypass consumer (token 00000000f3b0767a) registration fails: -16 [ 164.990904] binder: BINDER_SET_CONTEXT_MGR already set [ 165.007234] binder: 15191:15195 ioctl 40046207 0 returned -16 [ 165.016553] irq bypass consumer (token 00000000f3b1da00) registration fails: -16 03:01:06 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x4, &(0x7f00000001c0)}], 0x1, 0x0) [ 165.038639] binder_alloc: 15191: binder_alloc_buf, no vma [ 165.044288] binder: 15191:15204 transaction failed 29189/-3, size 24-8 line 2967 03:01:06 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x8000, 0x0) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)={0x3fc, r3, 0x20, 0x70bd27, 0x25dfdbfc, {0x1}, [{{0x8, 0x1, r1}, {0x1b0, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x8}}, {0x8, 0x7}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r1}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x80}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0xff}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r1}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8, 0x3, 0x5}, {0xc, 0x4, 'random\x00'}}}]}}, {{0x8, 0x1, r1}, {0x7c, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x80000001}}, {0x8, 0x6, r1}}}]}}, {{0x8, 0x1, r1}, {0x120, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0xeb}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x7fff}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x92}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x59}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r1}}}]}}, {{0x8, 0x1, r1}, {0x7c, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8, 0x3, 0xe}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r1}}}]}}]}, 0x3fc}, 0x1, 0x0, 0x0, 0x40850}, 0x80) 03:01:06 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5427, &(0x7f0000000040)) 03:01:06 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x3f00000000000000, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:06 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_buf(r4, 0x0, 0x37, &(0x7f0000000080)=""/71, &(0x7f0000000100)=0x47) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:06 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x700000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 165.125439] binder: undelivered TRANSACTION_ERROR: 29189 [ 165.139128] binder: send failed reply for transaction 366, target dead 03:01:06 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x1000000, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:06 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x5, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:06 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1600}) 03:01:06 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x800000001b, &(0x7f0000000200)={@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, r1}, 0x14) 03:01:06 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5416, &(0x7f0000000040)) [ 165.232150] binder: release 15251:15253 transaction 371 out, still active [ 165.239163] binder: unexpected work type, 4, not freed [ 165.244500] binder: undelivered TRANSACTION_COMPLETE [ 165.255338] binder_alloc: binder_alloc_mmap_handler: 15251 20001000-20004000 already mapped failed -16 03:01:06 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x3, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:06 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x8d8, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:06 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$restrict_keyring(0x1d, r3, &(0x7f00000000c0)='rxrpc\x00', 0x0) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r4}) 03:01:06 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0xc020660b, &(0x7f0000000040)) 03:01:06 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x80ffff00000000]}) [ 165.361746] binder: BINDER_SET_CONTEXT_MGR already set [ 165.385634] binder: 15251:15253 ioctl 40046207 0 returned -16 [ 165.405247] binder_alloc: 15251: binder_alloc_buf, no vma 03:01:06 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x80000, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f0000000100)={0x0, 0x1, 0x30, 0x4, 0x72}, &(0x7f0000000140)=0x18) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000240)={r3, @in6={{0xa, 0x4e21, 0xffffffff, @mcast2={0xff, 0x2, [], 0x1}, 0x7}}, 0x9, 0x400}, &(0x7f0000000180)=0x90) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x80, 0x0) getsockopt$inet6_udp_int(r4, 0x11, 0xa, &(0x7f0000000040), &(0x7f0000000080)=0x4) 03:01:06 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xfffffff0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:06 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x11, &(0x7f00000001c0)}], 0x1, 0x0) [ 165.411081] binder: 15251:15264 transaction failed 29189/-3, size 24-8 line 2967 03:01:06 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x200000000000000, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:06 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) r4 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x400, 0x511000) syz_open_pts(r4, 0x2000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:06 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) [ 165.503457] binder: send failed reply for transaction 371, target dead 03:01:06 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x300000000000000, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:06 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0xc0045878, &(0x7f0000000040)) 03:01:06 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x2, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:06 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x1000000000000]}) 03:01:06 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xa00, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:06 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x80, r4, 0x510, 0x70bd2b, 0x25dfdbff, {0xf}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_bridge\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x7}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x200}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x40}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x401}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}]}, 0x80}, 0x1, 0x0, 0x0, 0x4}, 0x40) r5 = dup2(r3, r0) ioctl$EVIOCGKEYCODE(r5, 0x80084504, &(0x7f00000003c0)=""/4096) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:06 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = memfd_create(&(0x7f0000000000)='trustedselinux\x00', 0x1) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000000c0)={{{@in=@broadcast, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@broadcast}}, &(0x7f0000000240)=0xe8) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000280)={0x0, @rand_addr, @dev}, &(0x7f00000002c0)=0xc) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x23, &(0x7f0000000300)={@empty, @dev, 0x0}, &(0x7f0000000340)=0xc) accept4$packet(0xffffffffffffffff, &(0x7f0000001740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000001780)=0x14, 0x80000) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000380)={0xffffffff}, 0x0, 0x100b}}, 0x20) write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f0000000400)={0x6, 0x118, 0xfa00, {{0xfff, 0xfffffffeffffffff, "afa090f4d2f158b829a5e7040510c228541d8846e6796540e2df30154d4bb6321dc4f240551383b48be9e73a72fe79dac0462302ace70ca1bc0bc3c1b9f2017a700f7a6f1dbaf75a49200a2b2157930aaa3ea8162ee7b8e05394211e9bcd1f2b9d3ddb2dea91bedeb2ada038d74b4666e7e2ff7d29033449e7a0e0dde33eedc8b2000a0968c82e1842c313da7c0178e20a50cb378aa0092faa2a50e03366fc055592537750a13da1230d93fefd9da44b55c1d97f52db434929ce6c3a21a53dc4f28ef2ed55f4615503ca032d46d6be516e585b2b4657c87e9a24ac88bb056e449e358eedbe513eeaa6c766a6598e04df36dec16250d0e6bf0855c2c85b5e8fa5", 0xf1, 0x400, 0x6, 0x2, 0x3, 0x80000001, 0x100000001}, r7}}, 0x120) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000017c0)={{{@in=@multicast2, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast1}}, &(0x7f00000018c0)=0xe8) getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000001900)={@dev, 0x0}, &(0x7f0000001940)=0x14) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000001980)={@broadcast, @multicast1, 0x0}, &(0x7f00000019c0)=0xc) accept4$packet(0xffffffffffffffff, &(0x7f0000001a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000001a40)=0x14, 0x80000) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000001b40)={'team0\x00', 0x0}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000001b80)={@dev, @remote, 0x0}, &(0x7f0000001bc0)=0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001c00)={{{@in6=@loopback, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@local}}, &(0x7f0000001d00)=0xe8) sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000002300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000022c0)={&(0x7f0000001d40)={0x56c, r2, 0x20, 0x70bd2b, 0x25dfdbfd, {}, [{{0x8, 0x1, r3}, {0x214, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r4}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8, 0x3, 0x5}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8, 0x3, 0x5}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4}}, {0x8, 0x7}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x7ff}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8, 0x3, 0xb}, {0x2c, 0x4, [{0x3, 0x6, 0x2, 0x401}, {0x5, 0x1000, 0x3a7f, 0x170e}, {0x200, 0x7, 0x4, 0xff}, {0x254, 0x8, 0x9, 0xfffffffffffffbff}, {0x3ff, 0x1b7952ca, 0x5, 0x9}]}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r6}}}]}}, {{0x8, 0x1, r8}, {0x3c, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x770}}}]}}, {{0x8, 0x1, r9}, {0x7c, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x4}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r10}}, {0x8, 0x7}}}]}}, {{0x8, 0x1, r11}, {0x44, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r12}}}]}}, {{0x8, 0x1, r13}, {0x220, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8, 0x3, 0x5}, {0x14, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0xfffffffffffffffb}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r14}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8, 0x3, 0x5}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}]}}]}, 0x56c}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r15}, 0x14) [ 165.578331] binder: undelivered TRANSACTION_ERROR: 29189 03:01:06 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x6c, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:06 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00'}) 03:01:06 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x4000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:06 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5437, &(0x7f0000000040)) [ 165.689292] binder: release 15346:15347 transaction 376 out, still active [ 165.696297] binder: unexpected work type, 4, not freed [ 165.701605] binder: undelivered TRANSACTION_COMPLETE [ 165.709101] binder_alloc: binder_alloc_mmap_handler: 15346 20001000-20004000 already mapped failed -16 03:01:06 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0xfdfdffff00000000]}) 03:01:06 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x21, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:06 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x100000000000000, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:06 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3}) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r1, 0x4010ae74, &(0x7f0000000080)={0x1, 0x4, 0xc12d}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) [ 165.773303] binder: BINDER_SET_CONTEXT_MGR already set [ 165.797231] binder: 15346:15347 ioctl 40046207 0 returned -16 03:01:06 executing program 1: ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x80000, 0x0) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000080)={@empty, r0}, 0x14) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/sequencer\x00', 0x10202, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r2, 0xc008551c, &(0x7f0000000040)=ANY=[@ANYBLOB="3f008002000000010000010000800200000005000000"]) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={0xffffffff}, 0x117, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r2, &(0x7f0000000200)={0x15, 0x110, 0xfa00, {r3, 0xc1, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x10001, @remote={0xfe, 0x80, [], 0xbb}, 0x6}, @in6={0xa, 0x4e24, 0x80000000, @empty, 0x400}}}, 0x118) [ 165.848143] binder_alloc: 15346: binder_alloc_buf, no vma [ 165.853798] binder: 15346:15351 transaction failed 29189/-3, size 24-8 line 2967 [ 165.933444] binder: undelivered TRANSACTION_ERROR: 29189 [ 165.946600] binder: send failed reply for transaction 376, target dead 03:01:07 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x3000000, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:07 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x2d80000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:07 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5421, &(0x7f0000000040)) 03:01:07 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x68000, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:07 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0xfdfdffff]}) 03:01:07 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@local={0xfe, 0x80, [], 0xaa}, r1}, 0x14) preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/221, 0xdd}, {&(0x7f0000000100)=""/23, 0x17}, {&(0x7f0000000240)=""/160, 0xa0}, {&(0x7f0000000300)=""/206, 0xce}, {&(0x7f0000000400)=""/232, 0xe8}], 0x5, 0x0) 03:01:07 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x82000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) modify_ldt$write(0x1, &(0x7f0000000000)={0x3, 0x20001000, 0x0, 0x1, 0x4, 0x4, 0x40, 0x1ff, 0x0, 0x3ff}, 0x10) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:07 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0xffffff7f, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:07 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x9d8, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:07 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x301, &(0x7f00000001c0)}], 0x1, 0x0) 03:01:07 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0) ioctl$RTC_ALM_READ(r1, 0x80247008, &(0x7f0000000080)) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f0000000000)={@mcast2={0xff, 0x2, [], 0x1}, r2}, 0x14) 03:01:07 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5424, &(0x7f0000000040)) [ 166.058199] binder: release 15417:15419 transaction 381 out, still active [ 166.065209] binder: unexpected work type, 4, not freed [ 166.070515] binder: undelivered TRANSACTION_COMPLETE [ 166.097517] binder_alloc: binder_alloc_mmap_handler: 15417 20001000-20004000 already mapped failed -16 03:01:07 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x80ffff]}) 03:01:07 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xe}], 0x1, 0x0) [ 166.126673] binder: BINDER_SET_CONTEXT_MGR already set 03:01:07 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) r4 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x3, 0x200200) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) mq_timedreceive(r4, &(0x7f0000000080)=""/57, 0x39, 0x0, &(0x7f0000000100)={r5, r6+30000000}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:07 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x3, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 166.187138] binder: 15417:15419 ioctl 40046207 0 returned -16 [ 166.197961] binder_alloc: 15417: binder_alloc_buf, no vma [ 166.203618] binder: 15417:15446 transaction failed 29189/-3, size 24-8 line 2967 [ 166.231512] binder: undelivered TRANSACTION_ERROR: 29189 [ 166.240199] binder: send failed reply for transaction 381, target dead 03:01:07 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0xfdfdffff, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:07 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) ioctl$sock_proto_private(r0, 0x89e7, &(0x7f0000000000)="33fbd8118b82ca0e2fa5aa3461a09727a94f6b5fe373683109a3cf7d6031c37361f2b913956fded5198713697d0389d1378a32b1d420f1816cdd2ac3a4c5fde6dac20a113cafa92cb2eaa51e17da1c62ef23fedbf3dfa5dfa077b8420643d78e8980be26ab24c9f155e5f528e07211c60d4f2df0461f845129a421a15e822d976de3d0d9484889c7ba6e0d6242aa5fdcf839380f3fd46889b3be0c6f4ace0eaf753a0e94fa0ed934e8416ea2ad49d43d5b5765") 03:01:07 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x2000000, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:07 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xd801, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:07 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x700000000000000}], 0x1, 0x0) 03:01:07 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5452, &(0x7f0000000040)) 03:01:07 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0xffff8000]}) 03:01:07 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x100, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000010}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="08042bbd7000fddbdf250a00000008000600020000092400000000000000"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x4001) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) 03:01:07 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x4000000}], 0x1, 0x0) [ 166.356910] binder: release 15469:15470 transaction 386 out, still active [ 166.363941] binder: unexpected work type, 4, not freed [ 166.369263] binder: undelivered TRANSACTION_COMPLETE [ 166.384680] binder_alloc: binder_alloc_mmap_handler: 15469 20001000-20004000 already mapped failed -16 03:01:07 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x7, 0x4000000008, r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:07 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xe4ffffff00000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 166.426590] binder: BINDER_SET_CONTEXT_MGR already set 03:01:07 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x80045432, &(0x7f0000000040)) [ 166.464210] binder: 15469:15470 ioctl 40046207 0 returned -16 [ 166.473145] binder_alloc: 15469: binder_alloc_buf, no vma [ 166.478866] binder: 15469:15480 transaction failed 29189/-3, size 24-8 line 2967 03:01:07 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xa00}], 0x1, 0x0) 03:01:07 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x2000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040)={0xffffffff}, 0x117, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r2, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000240), r3, 0x3}}, 0x18) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) 03:01:07 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0xfffffdfd]}) 03:01:07 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0xff03, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) [ 166.580936] binder: undelivered TRANSACTION_ERROR: 29189 [ 166.595304] binder: send failed reply for transaction 386, target dead 03:01:07 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x300, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:07 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x87e00000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:07 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x540b, &(0x7f0000000040)) 03:01:07 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xffffff97}], 0x1, 0x0) 03:01:07 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0xfffffffffffffffc, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x8912, &(0x7f0000000140)="025cc81d6d345f8f662070") r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000000)='gretap0\x00', 0x10) bind$llc(r4, &(0x7f0000000040)={0x1a}, 0x10) sendmmsg$inet_sctp(r4, &(0x7f0000000640)=[{&(0x7f0000000100)=@in6={0xa, 0x0, 0x10000, @remote={0xfe, 0x80, [], 0xbb}}, 0x1c, &(0x7f0000000440), 0x0, &(0x7f0000000480)}, {&(0x7f00000004c0)=@in={0x2}, 0x930000, &(0x7f0000000600)}], 0x2, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) ioctl$KVM_PPC_GET_PVINFO(r1, 0x4080aea1, &(0x7f0000000080)=""/123) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)) 03:01:07 executing program 1: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x20000, 0x0) setsockopt$packet_int(r0, 0x107, 0x0, &(0x7f0000000080)=0x40, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r1, 0x29, 0x0, &(0x7f0000000040)={@empty, r2}, 0xfffffce0) 03:01:07 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0xfdfdffff00000000]}) 03:01:07 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xffffff7f00000000}], 0x1, 0x0) 03:01:07 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x540c, &(0x7f0000000040)) 03:01:07 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x1, 0x0) write$P9_RLCREATE(r2, &(0x7f0000000080)={0x3d9, 0xf, 0x2, {{0x88, 0x200000003, 0x8}, 0x10001}}, 0xe2) 03:01:07 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x64020000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:07 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0xfffffffffffffffe) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) [ 166.751788] binder: release 15551:15552 transaction 391 out, still active [ 166.758800] binder: unexpected work type, 4, not freed [ 166.764111] binder: undelivered TRANSACTION_COMPLETE [ 166.774438] binder_alloc: binder_alloc_mmap_handler: 15551 20001000-20004000 already mapped failed -16 03:01:07 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x4000000000000000, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) [ 166.821052] binder: BINDER_SET_CONTEXT_MGR already set 03:01:07 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xe00}], 0x1, 0x0) 03:01:07 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x80ffff]}) 03:01:08 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getpeername(r0, &(0x7f0000000000)=@xdp, &(0x7f0000000080)=0x80) recvmmsg(r0, &(0x7f0000006bc0)=[{{&(0x7f0000000140)=@in6={0x0, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000002500)=[{&(0x7f0000000240)=""/173, 0xad}, {&(0x7f0000000300)=""/4096, 0x1000}, {&(0x7f0000001300)=""/139, 0x8b}, {&(0x7f00000013c0)=""/72, 0x48}, {&(0x7f0000001440)=""/13, 0xd}, {&(0x7f0000001480)=""/4096, 0x1000}, {&(0x7f0000002480)=""/95, 0x5f}], 0x7, 0x0, 0x0, 0x16}, 0x401}, {{&(0x7f0000002580)=@xdp, 0x80, &(0x7f0000003a40)=[{&(0x7f0000002600)=""/4096, 0x1000}, {&(0x7f0000003600)=""/48, 0x30}, {&(0x7f0000003640)=""/228, 0xe4}, {&(0x7f0000003740)=""/28, 0x1c}, {&(0x7f0000003780)=""/199, 0xc7}, {&(0x7f0000003880)=""/139, 0x8b}, {&(0x7f0000003940)=""/8, 0x8}, {&(0x7f0000003980)=""/184, 0xb8}], 0x8, &(0x7f0000003ac0)=""/98, 0x62, 0x20}, 0x1}, {{&(0x7f0000003b40), 0x80, &(0x7f0000003cc0)=[{&(0x7f0000003bc0)=""/30, 0x1e}, {&(0x7f0000003c00)=""/189, 0xbd}], 0x2, &(0x7f0000003d00)=""/84, 0x54, 0x7fffffff}, 0x7}, {{&(0x7f0000003d80)=@ax25, 0x80, &(0x7f0000004ec0)=[{&(0x7f0000003e00)=""/6, 0x6}, {&(0x7f0000003e40)=""/16, 0x10}, {&(0x7f0000003e80)=""/4096, 0x1000}, {&(0x7f0000004e80)}], 0x4, &(0x7f0000004f00)=""/119, 0x77, 0xe368}, 0x8001}, {{0x0, 0x0, &(0x7f0000004fc0)=[{&(0x7f0000004f80)}], 0x1, 0x0, 0x0, 0xa3}, 0x1}, {{&(0x7f0000005000)=@alg, 0x80, &(0x7f0000005340)=[{&(0x7f0000005080)=""/183, 0xb7}, {&(0x7f0000005140)=""/67, 0x43}, {&(0x7f00000051c0)=""/255, 0xff}, {&(0x7f00000052c0)=""/113, 0x71}], 0x4, &(0x7f0000005380)=""/81, 0x51, 0x3}, 0x100000000}, {{&(0x7f0000005400)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000056c0)=[{&(0x7f0000005480)=""/55, 0x37}, {&(0x7f00000054c0)=""/233, 0xe9}, {&(0x7f00000055c0)=""/229, 0xe5}], 0x3, &(0x7f0000005700)=""/175, 0xaf, 0x2}, 0xebe8}, {{&(0x7f00000057c0)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000006b40)=[{&(0x7f0000005840)=""/180, 0xb4}, {&(0x7f0000005900)=""/4096, 0x1000}, {&(0x7f0000006900)=""/201, 0xc9}, {&(0x7f0000006a00)=""/88, 0x58}, {&(0x7f0000006a80)=""/165, 0xa5}], 0x5, 0x0, 0x0, 0x8001}, 0x6}], 0x8, 0x40, &(0x7f0000006dc0)={0x0, 0x1c9c380}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000006ec0)={0x0, @dev}, &(0x7f0000006f00)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000006f40)={'team0\x00', r1}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r2}, 0x14) getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f00000000c0)=""/124, &(0x7f00000001c0)=0x7c) [ 166.866524] binder_alloc: 15551: binder_alloc_buf, no vma [ 166.872170] binder: 15551:15555 transaction failed 29189/-3, size 24-8 line 2967 [ 166.950607] binder: 15551:15552 ioctl 40046207 0 returned -16 03:01:08 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40086303, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:08 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x7000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:08 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5423, &(0x7f0000000040)) 03:01:08 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x9}], 0x1, 0x0) 03:01:08 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x149100, 0x0) getsockname$llc(r3, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000140)=0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000240)={{{@in=@rand_addr, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@multicast1}}, &(0x7f0000000340)=0xe8) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f00000003c0)=r4) r5 = eventfd(0x0) r6 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x1, 0x8840) ioctl$RTC_WKALM_RD(r6, 0x80287010, &(0x7f0000000080)) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000400)={{0x8000, 0xffffffffffff0001}, 'port0\x00', 0x1, 0x20, 0x5, 0x7ff, 0x95f7, 0xff98, 0x7fff, 0x0, 0x4, 0x6}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r5}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r5}) 03:01:08 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) r2 = getpgid(0x0) sched_setattr(r2, &(0x7f0000000000)={0x0, 0x3, 0x1, 0x80, 0x7000000000000000, 0x8001, 0x16, 0x297cd74c}, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) 03:01:08 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x1000000, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:08 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0xfdfdffff]}) [ 166.997563] binder: undelivered TRANSACTION_ERROR: 29189 [ 167.010460] binder: send failed reply for transaction 391, target dead 03:01:08 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xc0ffffff00000000}], 0x1, 0x0) 03:01:08 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5409, &(0x7f0000000040)) 03:01:08 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x3d8, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:08 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xc0ffffff}], 0x1, 0x0) 03:01:08 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0xffff8000]}) [ 167.100932] binder: release 15622:15623 transaction 396 out, still active [ 167.107953] binder: unexpected work type, 4, not freed [ 167.113251] binder: undelivered TRANSACTION_COMPLETE [ 167.121697] binder: 15622:15623 BC_FREE_BUFFER u0000000000000001 no match [ 167.137473] binder_alloc: binder_alloc_mmap_handler: 15622 20001000-20004000 already mapped failed -16 03:01:08 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0xd39) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:08 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xfd000000}], 0x1, 0x0) [ 167.222858] binder: BINDER_SET_CONTEXT_MGR already set [ 167.253143] binder: 15622:15623 ioctl 40046207 0 returned -16 03:01:08 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5425, &(0x7f0000000040)) [ 167.278304] binder_alloc: 15622: binder_alloc_buf, no vma [ 167.283956] binder: 15622:15626 transaction failed 29189/-3, size 24-8 line 2967 [ 167.309153] binder: 15622:15652 BC_FREE_BUFFER u0000000000000001 no match 03:01:08 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x4008630a, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:08 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xe00, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:08 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0xff030000, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:08 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0xfffffdfd]}) 03:01:08 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x1f) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) io_setup(0x3, &(0x7f0000000000)=0x0) io_cancel(r4, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x100000001, r3, &(0x7f0000000080)="3c1e91097a80dc752f060c786dafa201e9da00492aeed50a725a04ed52720798284e919785457faafb9400681ba8c9d6d2dcf9c222f5830ad527f1bd77183308286b1957bea8ed117c5e6ff2d99df9464cda84a163fc5645e08eac5190af3e133bc9c2a71953d7c74b642bb8d935f9892db0203683f360a51c78ea8edbdf95ff0ead23358a3f9be42a4b431b603928bdb06346fa0c9a5575e5968be4892957eb08617ddeb5a832db86caebcb58f382ac66f58d9cfdb702f66b3fb47a2923325c3105fd5e9123dc77318a", 0xca, 0x3ff, 0x0, 0x0, r3}, &(0x7f0000000200)) 03:01:08 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xa000000}], 0x1, 0x0) 03:01:08 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5450, &(0x7f0000000040)) 03:01:08 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1d, &(0x7f0000000000)={@mcast1={0xff, 0x1, [], 0x1}, r1}, 0x14) [ 167.347260] binder: undelivered TRANSACTION_ERROR: 29189 [ 167.364414] binder: send failed reply for transaction 396, target dead 03:01:08 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x80ffff00000000]}) 03:01:08 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x100000000000000}], 0x1, 0x0) 03:01:08 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0xc0045877, &(0x7f0000000040)) 03:01:08 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xd804, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 167.470987] binder: release 15688:15689 transaction 401 out, still active [ 167.478060] binder: unexpected work type, 4, not freed [ 167.483400] binder: undelivered TRANSACTION_COMPLETE [ 167.498183] binder: BC_ATTEMPT_ACQUIRE not supported 03:01:08 executing program 1: ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'team0\x00'}) prctl$setendian(0x14, 0x0) 03:01:08 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x40049409, &(0x7f0000000040)) 03:01:08 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x400000000000000}], 0x1, 0x0) [ 167.524914] binder: 15688:15689 ioctl c0306201 20000080 returned -22 03:01:08 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xd805, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 167.580802] binder_alloc: binder_alloc_mmap_handler: 15688 20001000-20004000 already mapped failed -16 [ 167.653355] binder: BINDER_SET_CONTEXT_MGR already set [ 167.685741] binder: 15688:15689 ioctl 40046207 0 returned -16 03:01:08 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40486312, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:08 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r2 = eventfd(0x10000008) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:08 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x1000000000000]}) 03:01:08 executing program 1: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x0, 0x0) r1 = gettid() mq_notify(r0, &(0x7f0000000080)={0x0, 0x5a, 0x1, @tid=r1}) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000040)=0x3, 0x4) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000200)={@empty, r3}, 0x14) 03:01:08 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x200000000000000}], 0x1, 0x0) 03:01:08 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x40000000, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:08 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x540d, &(0x7f0000000040)) 03:01:08 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xffffff8c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 167.698306] binder_alloc: 15688: binder_alloc_buf, no vma [ 167.703999] binder: 15688:15710 transaction failed 29189/-3, size 24-8 line 2967 [ 167.711161] binder: BC_ATTEMPT_ACQUIRE not supported [ 167.724900] binder: 15688:15732 ioctl c0306201 20000080 returned -22 [ 167.733304] binder: undelivered TRANSACTION_ERROR: 29189 [ 167.741497] binder: send failed reply for transaction 401, target dead 03:01:08 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541f, &(0x7f0000000040)) 03:01:08 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvmmsg(r0, &(0x7f0000004580)=[{{&(0x7f0000000080)=@ax25, 0x80, &(0x7f0000000240)=[{&(0x7f0000000100)=""/88, 0x58}, {&(0x7f0000000180)=""/30, 0x1e}], 0x2, &(0x7f0000000280)=""/89, 0x59, 0x4}, 0x1}, {{&(0x7f0000000300)=@ax25, 0x80, &(0x7f00000007c0)=[{&(0x7f0000000380)=""/45, 0x2d}, {&(0x7f00000003c0)=""/240, 0xf0}, {&(0x7f00000004c0)=""/131, 0x83}, {&(0x7f0000000580)=""/71, 0x47}, {&(0x7f0000000600)=""/5, 0x5}, {&(0x7f0000000640)=""/196, 0xc4}, {&(0x7f0000000740)=""/67, 0x43}], 0x7, &(0x7f0000000840)=""/110, 0x6e, 0x4}, 0x6}, {{&(0x7f00000008c0)=@ll, 0x80, &(0x7f0000000b40)=[{&(0x7f0000000940)=""/219, 0xdb}, {&(0x7f0000000a40)=""/208, 0xd0}], 0x2, &(0x7f0000000b80)=""/227, 0xe3, 0x7ff}, 0x2}, {{&(0x7f0000000c80)=@alg, 0x80, &(0x7f0000002f80)=[{&(0x7f0000000d00)=""/4096, 0x1000}, {&(0x7f0000001d00)=""/50, 0x32}, {&(0x7f0000001d40)=""/21, 0x15}, {&(0x7f0000001d80)=""/125, 0x7d}, {&(0x7f0000001e00)=""/250, 0xfa}, {&(0x7f0000001f00)=""/4096, 0x1000}, {&(0x7f0000002f00)=""/101, 0x65}], 0x7, &(0x7f0000003000)=""/97, 0x61, 0x7}, 0x5}, {{0x0, 0x0, &(0x7f00000032c0)=[{&(0x7f0000003080)=""/98, 0x62}, {&(0x7f0000003100)=""/243, 0xf3}, {&(0x7f0000003200)=""/144, 0x90}], 0x3, &(0x7f0000003300)=""/92, 0x5c, 0xf8}, 0x1f}, {{0x0, 0x0, &(0x7f0000004380)=[{&(0x7f0000003380)=""/4096, 0x1000}], 0x1, &(0x7f00000043c0)=""/158, 0x9e, 0xfffffffffffffff7}, 0x6}, {{&(0x7f0000004480)=@llc={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x80, &(0x7f0000004540)=[{&(0x7f0000004500)=""/7, 0x7}], 0x1, 0x0, 0x0, 0x1}, 0xa0a7}], 0x7, 0x1, &(0x7f0000004740)) getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f00000047c0)={@ipv4={[], [], @broadcast}}, &(0x7f0000004800)=0x14) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x20, &(0x7f0000005e00)={@rand_addr, @multicast2, 0x0}, &(0x7f0000005e40)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000004840)={'team0\x00', r1}) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$TUNSETTXFILTER(r3, 0x400454d1, &(0x7f00000001c0)={0x1, 0x2, [@random="85aeae9f2b4b", @random="dd16b2c2256a"]}) inotify_add_watch(r3, &(0x7f0000000040)='./file0\x00', 0x100) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r2}, 0x14) [ 167.813473] irq bypass consumer (token 000000001c7b9beb) registration fails: -16 [ 167.826335] binder: release 15754:15755 transaction 406 out, still active [ 167.833320] binder: unexpected work type, 4, not freed [ 167.838633] binder: undelivered TRANSACTION_COMPLETE [ 167.845439] binder: 15754:15755 got reply transaction with no transaction stack [ 167.852935] binder: 15754:15755 transaction failed 29201/-71, size 0-0 line 2759 03:01:08 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xe000000}], 0x1, 0x0) 03:01:09 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xd8000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:09 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0xeffdffff, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:09 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0xfffffdfd]}) [ 167.877015] irq bypass consumer (token 00000000beaab9f7) registration fails: -16 03:01:09 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0xc0189436, &(0x7f0000000040)) 03:01:09 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2, 0xfffffffffffffffc, 0xffffffffffffffff}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) [ 167.926534] QAT: Invalid ioctl [ 167.942602] binder_alloc: binder_alloc_mmap_handler: 15754 20001000-20004000 already mapped failed -16 [ 167.973302] QAT: Invalid ioctl [ 168.008457] binder_alloc: 15754: binder_alloc_buf, no vma [ 168.014079] binder: 15754:15773 transaction failed 29189/-3, size 24-8 line 2967 [ 168.020024] binder: BINDER_SET_CONTEXT_MGR already set [ 168.073189] irq bypass consumer (token 00000000da89f131) registration fails: -16 [ 168.083114] binder: 15754:15755 ioctl 40046207 0 returned -16 [ 168.088045] binder: 15754:15796 got reply transaction with no transaction stack [ 168.096527] binder: 15754:15796 transaction failed 29201/-71, size 0-0 line 2759 03:01:09 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40106308, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:09 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xd800, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:09 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) set_robust_list(&(0x7f0000000100)={&(0x7f0000000040)={&(0x7f0000000000)}, 0xc8, &(0x7f00000000c0)={&(0x7f0000000080)}}, 0x18) 03:01:09 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xfd}], 0x1, 0x0) 03:01:09 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x80ffff00000000]}) 03:01:09 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5414, &(0x7f0000000040)) 03:01:09 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x7) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:09 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x3f000000, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) [ 168.123235] binder: undelivered TRANSACTION_ERROR: 29189 [ 168.141186] binder: undelivered TRANSACTION_ERROR: 29201 [ 168.146741] binder: undelivered TRANSACTION_ERROR: 29201 [ 168.152239] binder: send failed reply for transaction 406, target dead 03:01:09 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5413, &(0x7f0000000040)) 03:01:09 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x1000000}], 0x1, 0x0) [ 168.203514] binder: 15805:15806 BC_INCREFS_DONE u0000000000000001 no match [ 168.226853] binder: release 15805:15806 transaction 413 out, still active [ 168.233938] binder: unexpected work type, 4, not freed [ 168.239229] binder: undelivered TRANSACTION_COMPLETE 03:01:09 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) socket$inet6(0xa, 0xb, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) [ 168.260618] binder_alloc: binder_alloc_mmap_handler: 15805 20001000-20004000 already mapped failed -16 [ 168.285499] binder: BINDER_SET_CONTEXT_MGR already set [ 168.295356] binder: 15805:15806 ioctl 40046207 0 returned -16 [ 168.303497] binder_alloc: 15805: binder_alloc_buf, no vma 03:01:09 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xffffffe4, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:09 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x282000, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r4, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x28, r5, 0x901, 0x70bd2a, 0x25dfdbfd, {0x1}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x1f}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x41}, 0x40) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='cmdline\x00') getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000080), &(0x7f00000000c0)=0xc) 03:01:09 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5418, &(0x7f0000000040)) 03:01:09 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x1000000000000]}) 03:01:09 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x9000000}], 0x1, 0x0) [ 168.309172] binder: 15805:15828 transaction failed 29189/-3, size 24-8 line 2967 [ 168.377008] binder: undelivered TRANSACTION_ERROR: 29189 [ 168.382736] binder: 15805:15828 BC_INCREFS_DONE u0000000000000001 no match 03:01:09 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40106309, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:09 executing program 1: ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'team0\x00'}) getsockopt$IP_VS_SO_GET_SERVICE(0xffffffffffffffff, 0x0, 0x483, &(0x7f0000000080), &(0x7f0000000100)=0x68) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) ptrace$getsig(0x4202, r0, 0x0, &(0x7f0000000040)) 03:01:09 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x4, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:09 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x40000, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:09 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5428, &(0x7f0000000040)) [ 168.422303] binder: send failed reply for transaction 413, target dead 03:01:09 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xfd00}], 0x1, 0x0) 03:01:09 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0xfdfdffff00000000]}) 03:01:09 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00'}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x400000, 0x0) 03:01:09 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) ioctl$KVM_GET_PIT(r1, 0xc048ae65, &(0x7f0000000080)) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x2) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3, 0x0, 0x28, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) [ 168.494344] binder: release 15863:15864 transaction 418 out, still active [ 168.501434] binder: unexpected work type, 4, not freed [ 168.506722] binder: undelivered TRANSACTION_COMPLETE [ 168.518209] binder: 15863:15864 BC_ACQUIRE_DONE u0000000000000001 no match [ 168.556678] binder_alloc: binder_alloc_mmap_handler: 15863 20001000-20004000 already mapped failed -16 [ 168.596851] binder: BINDER_SET_CONTEXT_MGR already set 03:01:09 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x4020940d, &(0x7f0000000040)) 03:01:09 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xffffffc0}], 0x1, 0x0) 03:01:09 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x800000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 168.607405] binder: 15863:15864 ioctl 40046207 0 returned -16 [ 168.636141] binder_alloc: 15863: binder_alloc_buf, no vma [ 168.641873] binder: 15863:15884 transaction failed 29189/-3, size 24-8 line 2967 03:01:09 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) socketpair$inet6_sctp(0xa, 0x5, 0x84, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000080)=0xffffffff00000001, 0x4) r3 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0xfc, 0x8000) write$P9_RREADDIR(r3, &(0x7f0000000400)=ANY=[@ANYBLOB="03010000290100070000001000000000070000000000000065000000000000000007002e2f66696c65300c010000000100000000000000d1000000000000000907002e2f66696c6530500300000004000000000080000000000000ff07002e2f66696c6530200100000001000000000000005400000000000000ff07002e2f66696c65300102000000010000000000000040000000000000000107002e2f66696c6530510400857ba6b03f3da4fe7261e7257096f5680000000000000000000000000000000000200007002e2f66696c65300203000000000000000000000008000000000000008007002e2f66696c65300004000000000000000000000000800000000000000607e82d2f66696c653092473c7f480101255e22e223e1b8e86ce4b2748f643abbbe7798ed25385e0343f3e433bf66b4dfed8121105afdbceef1a4728a1a447cb9783bdfec616a8a6e2d2e8449ecead52e894db38e4d378acbb3ea80710e92e2310f9b6658b89103ab2ba5b45f6af2873bda0e95649bcfa2d1afeeef4c22aeb8a4"], 0x103) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) 03:01:09 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x80ffff]}) 03:01:09 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xfd00000000000000}], 0x1, 0x0) 03:01:09 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5451, &(0x7f0000000040)) [ 168.704547] binder: 15863:15912 BC_ACQUIRE_DONE u0000000000000001 no match [ 168.711755] binder: undelivered TRANSACTION_ERROR: 29189 03:01:09 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40486311, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:09 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x4, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:09 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) r4 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x10001, 0x8400) ioctl$TCGETA(r4, 0x5405, &(0x7f0000000080)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:09 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xffffffff00000000}], 0x1, 0x0) 03:01:09 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x3d80000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:09 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x17, &(0x7f0000000040)={@remote={0xfe, 0x80, [], 0xbb}, r1}, 0x14) r2 = fcntl$dupfd(r0, 0x406, r0) ioctl$KVM_S390_UCAS_UNMAP(r2, 0x4018ae51, &(0x7f0000000000)={0x133a484f, 0x4, 0x3}) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000080)=0x2, 0x4) 03:01:09 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0xfffffdfd}) 03:01:09 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0xfdfdffff]}) [ 168.778844] binder: send failed reply for transaction 418, target dead 03:01:10 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x97ffffff00000000}], 0x1, 0x0) 03:01:10 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) connect(r0, &(0x7f0000000000)=@ethernet={0x6}, 0x80) [ 168.894456] binder: release 15953:15954 transaction 423 out, still active [ 168.901473] binder: unexpected work type, 4, not freed [ 168.906765] binder: undelivered TRANSACTION_COMPLETE [ 168.915698] binder: 15953:15954 transaction failed 29189/-22, size 0-0 line 2852 03:01:10 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xffffff7f, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:10 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000000)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:10 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0xffff8000]}) [ 168.953188] binder_alloc: binder_alloc_mmap_handler: 15953 20001000-20004000 already mapped failed -16 03:01:10 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0xfdfdffff00000000}) 03:01:10 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) r2 = socket$inet6(0xa, 0x1, 0x8) r3 = dup2(r2, r2) setsockopt$bt_rfcomm_RFCOMM_LM(r3, 0x12, 0x3, &(0x7f0000000180)=0x1, 0x4) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffff9c, 0x84, 0x70, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e21, 0x7ff, @mcast2={0xff, 0x2, [], 0x1}, 0x4}}, [0x38f51a36, 0x1000, 0x6, 0xffffffff00000001, 0x4, 0x9, 0x9, 0xfffffffffffffffd, 0x80000000, 0x7f, 0x7, 0x10000, 0xe6, 0x4ccb, 0x8]}, &(0x7f0000000100)=0x100) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000240)={r4, 0x1, 0x0, 0xe, 0x401}, &(0x7f0000000280)=0x18) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000140)={r4, 0x4000000002, 0x20}, 0xffffffb2) fanotify_init(0x40, 0x0) 03:01:10 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x900000000000000}], 0x1, 0x0) [ 169.041904] binder: BINDER_SET_CONTEXT_MGR already set [ 169.070719] irq bypass consumer (token 000000002dd27012) registration fails: -16 [ 169.084598] binder: 15953:15954 ioctl 40046207 0 returned -16 [ 169.114874] binder_alloc: 15953: binder_alloc_buf, no vma [ 169.120527] binder: 15953:15965 transaction failed 29189/-3, size 24-8 line 2967 [ 169.168307] binder: 15953:15998 got transaction to invalid handle [ 169.174731] binder: 15953:15998 transaction failed 29201/-22, size 0-0 line 2852 [ 169.176359] binder: undelivered TRANSACTION_ERROR: 29189 [ 169.198120] binder: undelivered TRANSACTION_ERROR: 29201 [ 169.212089] binder: undelivered TRANSACTION_ERROR: 29189 03:01:10 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x630b, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:10 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0xe803, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:10 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x7d8, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:10 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x97ffffff}], 0x1, 0x0) 03:01:10 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0xffff8000]}) 03:01:10 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0x3ff, 0x400000) write$cgroup_subtree(r3, &(0x7f0000000100)=ANY=[@ANYBLOB="2b70696473202b637075202d696f202b72646d6112f5637075202d696f20"], 0x1e) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r4}) r5 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x40, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x101, 0x0) ioctl$SG_GET_REQUEST_TABLE(r5, 0x2286, &(0x7f00000001c0)) 03:01:10 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0xfdfdffff}) [ 169.217607] binder: send failed reply for transaction 423, target dead 03:01:10 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) select(0x40, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), &(0x7f0000000540)={0x0, 0x2710}) r0 = msgget$private(0x0, 0x100) msgctl$IPC_STAT(r0, 0x2, &(0x7f0000000040)=""/201) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000280)='/dev/hwrng\x00', 0x1fffc, 0x0) ioctl$BLKTRACESTOP(r3, 0x1275, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000200)={@empty, r2}, 0x14) 03:01:10 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x300, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:10 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x900}], 0x1, 0x0) 03:01:10 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0xfdfdffff}) 03:01:10 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) r4 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x100, 0x400) ioctl$sock_inet_tcp_SIOCINQ(r4, 0x541b, &(0x7f0000000080)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) [ 169.293888] binder: release 16028:16029 transaction 430 out, still active [ 169.300879] binder: unexpected work type, 4, not freed [ 169.306192] binder: undelivered TRANSACTION_COMPLETE [ 169.312991] binder: 16028:16029 ERROR: BC_REGISTER_LOOPER called without request [ 169.320627] binder: 16028:16029 unknown command 1 03:01:10 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0xfffffdfd]}) 03:01:10 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x10001, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r2, 0x40087705, &(0x7f0000000040)={0x6, 0x1000}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) fsync(r0) 03:01:10 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x7, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:10 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x700}], 0x1, 0x0) [ 169.443334] binder: 16028:16029 ioctl c0306201 20000080 returned -22 [ 169.491537] binder_alloc: binder_alloc_mmap_handler: 16028 20001000-20004000 already mapped failed -16 [ 169.542549] binder: BINDER_SET_CONTEXT_MGR already set [ 169.552142] binder: 16028:16029 ioctl 40046207 0 returned -16 [ 169.562349] binder_alloc: 16028: binder_alloc_buf, no vma [ 169.567972] binder: 16028:16066 transaction failed 29189/-3, size 24-8 line 2967 [ 169.575765] binder: 16028:16075 ERROR: BC_REGISTER_LOOPER called without request [ 169.580629] binder: undelivered TRANSACTION_ERROR: 29189 03:01:10 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046302, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:10 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x3f00, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:10 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0xfffffdfd}) 03:01:10 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$l2tp(0x18, 0x1, 0x1) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000001dc0)={'team0\x00'}) getpeername$packet(0xffffffffffffff9c, &(0x7f0000001f40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000001f80)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000001c0)={'team0\x00', r2}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r3}, 0x14) clock_getres(0x6, &(0x7f0000000000)) 03:01:10 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0xffd7000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:10 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) r4 = syz_open_pts(r2, 0x10000) ioctl$TIOCLINUX2(r4, 0x541c, &(0x7f0000000000)={0x2, 0x3ff, 0x1f, 0x9, 0x7ff, 0x8}) mount$9p_xen(&(0x7f0000000080)='/dev/kvm\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x400, &(0x7f0000000140)={'trans=xen,', {[{@noextend='noextend', 0x2c}]}}) 03:01:10 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x80ffff00000000]}) 03:01:10 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x4}], 0x1, 0x0) [ 169.583346] binder: 16028:16075 unknown command 1 [ 169.593689] binder: 16028:16075 ioctl c0306201 20000080 returned -22 [ 169.615164] binder: send failed reply for transaction 430, target dead 03:01:10 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x6503000000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:10 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x7}], 0x1, 0x0) 03:01:10 executing program 1: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000180)='/dev/snapshot\x00', 0x0, 0x0) ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000240)=""/4096) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x240100, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000140)) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) socketpair(0xa, 0x807, 0x2, &(0x7f0000000000)={0xffffffffffffffff}) connect$netlink(r4, &(0x7f0000000040)=@unspec, 0xc) ioctl$EVIOCGRAB(r2, 0x40044590, &(0x7f00000000c0)=0x11e0) setsockopt$inet6_mreq(r1, 0x29, 0x14, &(0x7f0000000200)={@empty, r3}, 0x14) accept$inet6(r1, 0x0, &(0x7f0000000080)) ioctl$KVM_ASSIGN_SET_INTX_MASK(r4, 0x4040aea4, &(0x7f0000001240)={0x1, 0x95, 0x9, 0x7, 0x9}) socket$inet_sctp(0x2, 0x5, 0x84) 03:01:10 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x1000000000000]}) [ 169.695193] binder: release 16102:16103 transaction 435 out, still active [ 169.702237] binder: unexpected work type, 4, not freed [ 169.707545] binder: undelivered TRANSACTION_COMPLETE [ 169.713423] binder: BC_ACQUIRE_RESULT not supported [ 169.729328] binder: 16102:16103 ioctl c0306201 20000080 returned -22 03:01:10 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0xfdfdffff00000000}) 03:01:10 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0xfffffdef, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) [ 169.749783] binder_alloc: binder_alloc_mmap_handler: 16102 20001000-20004000 already mapped failed -16 03:01:10 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x2}], 0x1, 0x0) 03:01:10 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x1000000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 169.820643] binder: BINDER_SET_CONTEXT_MGR already set [ 169.838704] binder: 16102:16103 ioctl 40046207 0 returned -16 [ 169.878096] binder_alloc: 16102: binder_alloc_buf, no vma [ 169.883769] binder: 16102:16108 transaction failed 29189/-3, size 24-8 line 2967 [ 169.941853] binder: undelivered TRANSACTION_ERROR: 29189 [ 169.954264] binder: BC_ACQUIRE_RESULT not supported [ 169.970235] binder: 16102:16148 ioctl c0306201 20000080 returned -22 03:01:11 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046312, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:11 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x101) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:11 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0xfdfdffff00000000]}) 03:01:11 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0xfffffdfd}) 03:01:11 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xa00000000000000}], 0x1, 0x0) 03:01:11 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x7009, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:11 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) r2 = dup3(r0, r0, 0x80000) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000300)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000340)={{{@in=@broadcast, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@multicast2}}, &(0x7f0000000440)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000480)={0x0, 0x0, 0x0}, &(0x7f00000004c0)=0xc) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000500)=0x0) lstat(&(0x7f0000000540)='./file0\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000600), &(0x7f0000000640)=0x0, &(0x7f0000000680)) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000006c0)=0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000700)={{{@in=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000800)=0xe8) fstat(r0, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r12 = getpgid(0xffffffffffffffff) accept4$llc(r2, &(0x7f00000010c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000001100)=0x10, 0x80000) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000008c0)={{{@in6=@loopback, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f00000009c0)=0xe8) fstat(r0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(r0, 0x10, &(0x7f0000000a80)={0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000ac0)={{{@in=@loopback, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@dev}}, &(0x7f0000000bc0)=0xe8) ioctl$KVM_SET_DEBUGREGS(r2, 0x4080aea2, &(0x7f0000001040)={[0x4000, 0x7001, 0x4, 0x5002], 0x2, 0x2, 0x7}) fstat(r0, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(r0, 0x10, &(0x7f0000000c80)={0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000cc0)={{{@in, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@dev}}, &(0x7f0000000dc0)=0xe8) fstat(r0, &(0x7f0000000e00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r2, &(0x7f0000001000)={&(0x7f0000000000)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000000180)=[{&(0x7f0000000080)="d03f396b51f97035d01dacc1bce58fcf", 0x10}, {&(0x7f00000000c0)="c5753cb291d00cf0573df607ee53b87b71da28649b5989ca3f6c9aa61a47c813a8c52cb988d7197e1d82b9bf20053d646904c69c2427537312df30cc60878099ed0771d4b66c4355aefcf5a353c5fc439083f828ab5ca19d8db07e37200e5ed9f00bcfb8fdd72c62c0681804fb4f696bdba37c9c328c37f09093df58d46362e09af01a2bbcbea03320df9c472c102040c22511feefe3ff52e2d76ee47560979ce2ce35aebafcd7d079341f94e2bd145d56217d", 0xb3}, {&(0x7f0000000240)="162384ed0c41a7dd04bced72e6207fbc7d0a257cf75b270bbde0b101cb5b956e6b9f24dab121892b3918ed948316da4b8dd2552b2e899fb2fa29ee358c49ca2ed6e68a33eb59e5e855e4c2423d553c07f4db7add72d764e674ef5984f3f31d48da62812a712e689c45a281121d3f902a4112db69f57c212cad9330fffb2dc4e3e290c43b88bc907842251f85663872", 0x8f}], 0x3, &(0x7f0000000e80)=[@cred={0x20, 0x1, 0x2, r3, r4, r5}, @rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r6, r7, r8}, @cred={0x20, 0x1, 0x2, r9, r10, r11}, @rights={0x38, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r12, r13, r14}, @rights={0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r15, r16, r17}, @cred={0x20, 0x1, 0x2, r18, r19, r20}, @rights={0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0]}], 0x180}, 0x8000) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) 03:01:11 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x3e8, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) [ 169.995164] binder: send failed reply for transaction 435, target dead 03:01:11 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/igmp\x00') getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000140), &(0x7f00000001c0)=0x4) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x2000, 0x0) write$P9_RLOCK(r3, &(0x7f0000000080)={0x8, 0x35, 0x1}, 0x8) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000015c0)={r4}) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000180)={r5}) openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp\x00', 0x0, 0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000040)={r5}) 03:01:11 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xffffff7f}], 0x1, 0x0) 03:01:11 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='.p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:11 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x2, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f0000000040)={0x9, 0x0, [{0xc000000d, 0x10000, 0x935, 0x2, 0x1}, {0xd, 0xffffffffffff9141, 0x9, 0x2, 0x800}, {0xec5d8ccef14e0aff, 0xffffffff00000001, 0x100000000, 0x9, 0x1}, {0x0, 0x1ff, 0xff, 0x4, 0x3}, {0x8000001f, 0x800, 0x7, 0x1, 0x1}, {0x1, 0x80000001, 0x8, 0xc5, 0x1}, {0x80000000, 0x1, 0x3, 0x1f, 0x5}, {0x80000001, 0x6, 0x100000001, 0x8, 0x3}, {0x80000008, 0x9, 0x1f, 0xf85, 0x10000}]}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@remote={0xfe, 0x80, [], 0xbb}, r2}, 0x261) [ 170.078652] binder: release 16173:16176 transaction 440 out, still active [ 170.085737] binder: unexpected work type, 4, not freed [ 170.091032] binder: undelivered TRANSACTION_COMPLETE [ 170.096760] binder: 16173:16176 unknown command 1074029330 03:01:11 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0xe803000000000000, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:11 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0xfdfdffff00000000}) [ 170.120239] binder: 16173:16176 ioctl c0306201 20000080 returned -22 [ 170.149663] Unknown ioctl 1074310794 03:01:11 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x80ffff]}) 03:01:11 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xa}], 0x1, 0x0) [ 170.192928] Unknown ioctl 1074310794 [ 170.193118] binder_alloc: binder_alloc_mmap_handler: 16173 20001000-20004000 already mapped failed -16 [ 170.286779] binder: BINDER_SET_CONTEXT_MGR already set [ 170.320013] binder: 16173:16176 ioctl 40046207 0 returned -16 [ 170.349462] binder: 16173:16223 unknown command 1074029330 [ 170.349478] binder_alloc: 16173: binder_alloc_buf, no vma [ 170.360811] binder: 16173:16197 transaction failed 29189/-3, size 24-8 line 2967 03:01:11 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x400c630f, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:11 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x80, 0x0, r3}) 03:01:11 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000040)={'veth0_to_bond\x00', {0x2, 0x4e20}}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000000)={@dev={0xfe, 0x80, [], 0x18}, r1}, 0x14) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffff9c, 0x84, 0x77, &(0x7f0000000080)=ANY=[@ANYRES32=0x0, @ANYBLOB="1200012c54eb5200"], &(0x7f00000000c0)=0xc) r3 = syz_open_dev$usbmon(&(0x7f00000003c0)='/dev/usbmon#\x00', 0x5, 0x8000) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000400)='dctcp\x00', 0x6) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0x141100, 0x0) bind$xdp(r3, &(0x7f0000000440)={0x2c, 0x2, r1, 0xe, 0xffffffffffffff9c}, 0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000180)={0x0}, &(0x7f0000000300)=0xc) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000340)={[], 0x3, 0x1000, 0x0, 0x80, 0x2, r5}) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000200)={r2, @in6={{0xa, 0x4e21, 0x6, @mcast1={0xff, 0x1, [], 0x1}, 0x2}}, [0x1, 0x3, 0xfff, 0xe70, 0xae36, 0x5000000000000, 0x96, 0x5, 0x81, 0x401, 0x4256, 0xe70, 0x7, 0x4, 0x6]}, &(0x7f0000000100)=0x100) 03:01:11 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0xe00000000000000}], 0x1, 0x0) 03:01:11 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0xfdfdffff]}) 03:01:11 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='/p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:11 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x4000000000000, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:11 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0xfdfdffff}) [ 170.362984] binder: 16173:16223 ioctl c0306201 20000080 returned -22 [ 170.382320] binder: send failed reply for transaction 440, target dead [ 170.390451] binder: undelivered TRANSACTION_ERROR: 29189 03:01:11 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xfffffdfd}) 03:01:11 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000000)={'bpq0\x00', {0x2, 0x4e24, @multicast2=0xe0000002}}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) 03:01:11 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x2000000}], 0x1, 0x0) [ 170.458643] irq bypass consumer (token 00000000eb73c85b) registration fails: -16 [ 170.472518] binder: release 16247:16248 transaction 445 out, still active [ 170.479531] binder: unexpected work type, 4, not freed [ 170.484830] binder: undelivered TRANSACTION_COMPLETE [ 170.490336] binder: 16247:16248 BC_CLEAR_DEATH_NOTIFICATION death notification not active 03:01:11 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) [ 170.506013] binder_alloc: binder_alloc_mmap_handler: 16247 20001000-20004000 already mapped failed -16 03:01:11 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9/\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:11 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x7000000}], 0x1, 0x0) [ 170.567627] binder: BINDER_SET_CONTEXT_MGR already set 03:01:11 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) r3 = dup(r2) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r3, 0x894b, &(0x7f0000000000)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r4}) 03:01:11 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x40, 0x0) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') getsockopt$inet6_mreq(r0, 0x29, 0x0, &(0x7f0000000180)={@loopback, 0x0}, &(0x7f0000000240)=0x14) getsockopt$inet6_mreq(r0, 0x29, 0x1d, &(0x7f0000000280)={@mcast2, 0x0}, &(0x7f00000002c0)=0x14) accept4$packet(0xffffffffffffff9c, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000340)=0x14, 0x80000) getsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f00000003c0)={@mcast1, 0x0}, &(0x7f0000000400)=0x14) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000480)=0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000004c0)={'bond_slave_0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000000740)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000700)={&(0x7f0000000500)={0x1dc, r2, 0x0, 0x70bd2b, 0x25dfdbfd, {0x2}, [{{0x8, 0x1, r3}, {0x7c, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x100}}, {0x8, 0x7}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r4}}}]}}, {{0x8, 0x1, r5}, {0xb8, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8, 0x3, 0x5}, {0xc, 0x4, 'hash\x00'}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r6}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r7}}, {0x8, 0x7}}}]}}, {{0x8, 0x1, r8}, {0x7c, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x1000}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x80000000}}, {0x8, 0x7, 0x2}}}]}}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x4001}, 0x0) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f00000000c0)=r4) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r9}, 0x14) [ 170.606756] binder: 16247:16248 ioctl 40046207 0 returned -16 [ 170.639520] binder_alloc: 16247: binder_alloc_buf, no vma [ 170.645188] binder: 16247:16251 transaction failed 29189/-3, size 24-8 line 2967 [ 170.669719] QAT: Invalid ioctl [ 170.675397] binder: 16247:16278 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 170.708710] binder: undelivered TRANSACTION_ERROR: 29189 [ 170.712350] QAT: Invalid ioctl [ 170.716499] binder: send failed reply for transaction 445, target dead 03:01:11 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x630d, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:11 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xfdfdffff00000000}) 03:01:11 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0xe8030000, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:11 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0x700000000000000}], 0x1, 0x0) 03:01:11 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) 03:01:11 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000200)='/dev/full\x00', 0x240, 0x0) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000280)={0x2, r2, 0x1}) ioctl$RTC_ALM_SET(r3, 0x40247007, &(0x7f0000000240)={0x1d, 0x33, 0x3, 0xc, 0x7, 0x223, 0x2, 0xb6, 0xffffffffffffffff}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r1, 0x396a, 0x400000, r1}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r1, 0x7, 0x1, r2}) r4 = eventfd(0x0) r5 = memfd_create(&(0x7f00000000c0)='\x00', 0x3) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000001c0)={r5, 0x50, &(0x7f0000000100)}, 0x10) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r4}) 03:01:11 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ipddp0\x00'}) recvmmsg(r0, &(0x7f0000000540)=[{{&(0x7f0000000300)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000380)=""/218, 0xda}, {&(0x7f0000000480)=""/74, 0x4a}], 0x2, 0x0, 0x0, 0x8}, 0x401}], 0x1, 0x20, &(0x7f0000000580)={0x77359400}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000180)={'team0\x00', r1}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r2}, 0x14) 03:01:11 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9o\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:11 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0xe00000000000000}], 0x1, 0x0) 03:01:11 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xfdfdffff}) [ 170.863446] binder: release 16318:16321 transaction 450 out, still active [ 170.870484] binder: unexpected work type, 4, not freed [ 170.875796] binder: undelivered TRANSACTION_COMPLETE [ 170.884402] binder: 16318:16321 unknown command 1 03:01:12 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x4000, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:12 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x80ffff]}) 03:01:12 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) keyctl$join(0x1, &(0x7f0000000000)={0x73, 0x79, 0x7a, 0x2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x42c0, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:12 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9q\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 170.918977] binder: 16318:16321 ioctl c0306201 20000080 returned -22 03:01:12 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0x97ffffff00000000}], 0x1, 0x0) [ 170.963522] binder_alloc: binder_alloc_mmap_handler: 16318 20001000-20004000 already mapped failed -16 03:01:12 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0xfffffdfd}) [ 171.032046] binder: BINDER_SET_CONTEXT_MGR already set [ 171.037448] binder_alloc: 16318: binder_alloc_buf, no vma [ 171.043084] binder: 16318:16340 transaction failed 29189/-3, size 24-8 line 2967 [ 171.094736] binder: 16318:16321 ioctl 40046207 0 returned -16 [ 171.114685] binder: 16318:16365 unknown command 1 [ 171.120767] binder: undelivered TRANSACTION_ERROR: 29189 [ 171.129864] binder: 16318:16365 ioctl c0306201 20000080 returned -22 03:01:12 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40406300, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:12 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0xffff) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2, 0x0, 0xfffffffffffffffe}) r3 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x0, 0x189200) setsockopt$llc_int(r3, 0x10c, 0x7, &(0x7f00000000c0)=0xe3, 0x4) ioctl$KVM_ASSIGN_SET_INTX_MASK(r1, 0x4040aea4, &(0x7f0000000000)={0x9, 0x7, 0x6, 0x1, 0x3}) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r4, 0x0, 0x0, r4}) 03:01:12 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0x9000000}], 0x1, 0x0) 03:01:12 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) 03:01:12 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x0, 0x3f00, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:12 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 171.153656] binder: send failed reply for transaction 450, target dead [ 171.216463] irq bypass consumer (token 000000003f801e73) registration fails: -16 [ 171.226723] binder: release 16384:16385 transaction 455 out, still active [ 171.233826] binder: unexpected work type, 4, not freed [ 171.239127] binder: undelivered TRANSACTION_COMPLETE [ 171.244520] binder: 16384:16385 transaction failed 29189/-22, size 0-0 line 2852 [ 171.264895] binder_alloc: binder_alloc_mmap_handler: 16384 20001000-20004000 already mapped failed -16 [ 171.294388] binder_alloc: 16384: binder_alloc_buf, no vma [ 171.300043] binder: 16384:16388 transaction failed 29189/-3, size 24-8 line 2967 [ 171.321601] binder: BINDER_SET_CONTEXT_MGR already set [ 171.332505] binder: 16384:16385 ioctl 40046207 0 returned -16 [ 171.332919] binder: 16384:16395 got transaction to invalid handle [ 171.343838] binder: undelivered TRANSACTION_ERROR: 29189 [ 171.344768] binder: 16384:16395 transaction failed 29201/-22, size 0-0 line 2852 [ 171.362062] binder: undelivered TRANSACTION_ERROR: 29201 [ 171.367559] binder: undelivered TRANSACTION_ERROR: 29189 [ 171.373079] binder: send failed reply for transaction 455, target dead 03:01:12 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x7, 0x100) setsockopt$IP_VS_SO_SET_TIMEOUT(r1, 0x0, 0x48a, &(0x7f00000000c0)={0x7fffffff, 0xb9e, 0x400}, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00'}) getsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000140)={@local, @rand_addr}, &(0x7f0000000180)=0xc) setsockopt$inet_mreqsrc(r1, 0x0, 0x2f, &(0x7f0000000100)={@broadcast=0xffffffff, @local={0xac, 0x14, 0x14, 0xaa}, @local={0xac, 0x14, 0x14, 0xaa}}, 0xc) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast2, @loopback, @rand_addr}, &(0x7f0000000040)=0xc) 03:01:12 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000}) 03:01:12 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0xe000000}], 0x1, 0x0) 03:01:12 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0xffff8000]}) 03:01:12 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:12 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) eventfd(0x0) r2 = eventfd(0x10000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r2}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x80400, 0x0) ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000080)=""/99) r3 = syz_open_procfs(0x0, &(0x7f0000000100)='pagemap\x00') getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r3, 0x84, 0x6d, &(0x7f00000002c0)={0x0, 0xa2, "2bcc98100478fe94ca3e20561e51fed9c0a57c0ba13ff9cc57026dd788be3178653ce71ddb03d19256ae633dda3089b975ea698bbfe258705e19261de6aa0473205c15955e37ad1032bb13989f0cad4af3a2346aeb35f5dd2c56b0989a88261a0543fa124cffc6c7fc29e56409d02842ccabe98e9dc09b0766c53af71184e5b82d823b76ea316128cfbfc56d6f1eb158289969fe0e0ccae2b455cc382f50082f3b03"}, &(0x7f00000003c0)=0xaa) sync_file_range(r0, 0x3, 0x5000, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f00000001c0)={r4, 0xfe46, "f00f586b524d3c19ed8ea744c4581ceafde7390add48c940b4ffa4866579736483bb15d919e4318aeba171dd31f35324f92834a5b20ff77d3c755a457d95f3d47ecb419d50bfc2ec9da0e624207ca33236714294c0a62fda41f4bf5957218a856de029be"}, &(0x7f0000000140)=0x6c) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000240)={r5, 0x8000}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f0000000400)={r5, 0xff, 0xffffffff, 0x5, 0x3, 0x6}, 0x14) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r3, 0x84, 0x1b, &(0x7f0000000440)={r4, 0x1000, "1834aca824ed0e2df1ae163f2ad2b4eaa5cace798b7542562b2b52463ffddc056322b9b0fa5dce8c36ce7ba0053703098e77b705befe6bb9d84b7775b841d7eba3670dddba88d8876d49e0c9aaf5398eba416ceda1b7b46c7da48304dd6340bc1a9ea7836f414bffa4c7c7104a31ea3c55f5fe472d3eff9db288a4fe8b25f0ac46bf1702385d3b8e00ce0e0657c196e67729080bc7756bc82719139b3888089b5b4eeaad92f1c5075b6eb543d91fef61c75088a8be25168c20703bac3813850f4e0a4a2af39cc9f96f92570244bbc6fee7b369beede7e797b5d416b27a52bd10865922e6de44b1e7ee3c9b1e4f242bfa87d1e35d41e1636920b4a334d3329f06b5bd142801f7b7c4af2770e6b9870beccb5d4476c738d70c1ce8120b1d8f9012dbef48636c60f30e98c87c11092c9a7ceb874335532c933fcecb8e21d0e079f8c9e7ced890446c4be297817383b2a35603d6ffed37fae27e958d51b92129b33ec48d9ab045d6450e1f394f07e94ea8b2792240d35007515077a25b924f6a88088d53cebeedaa49a1dcac55fc00f8fd796a77387c3f1f7b1692d26164b4bbff701600e37df530012aab7f8971b55fa5ee465fc10a0aa787233e087ee7feecb88f6e759a7c4bf28f01c1154e6802e9ac1f9774244f6eedae16f93659542c2a1fd0ce0ff53669d675855750dc7c78b549cf956b124f6819bb9c1950646ade15929a1839290cf7aadf7276eb96578aa06bcf57bdec4f2b42f09d2b3787ccd583e7e119a54fb76d4f953fd081264bdb9f6ea47069b0a2186c1425cc6e4f6089030fe4fbd055c01501376eca1f6d36d535235adbfe95a2962cbfee09b9588a42f923bb8bb07f23da4528d42caccc7c8cd514590992062625882d703972808f04c5540cd533d23b301e93881ef34361c95374168044598dbd586322ed54210d3ed7e4a1e07854f20517a7e960729b0c5aee4ab9b282ee8435aa9d7ecf2f8367d5f51cc08cede3314b56a72bea0619c819e8290e846cbdc8ba4a8f418a6614d98ef396f2dfae775dada97cafe4083cb115c31097f9d71bbdabd49f9d9e6beb14048050a51d7f19a4412e21160bce933d8ace775aeba1e2e7310e37ffe2b298cf6b0fb0b9d9a1e8dfebf43b602f833acb879c82ce9582633c9f55e74a14e634a19e98b0f5fe93508ee7c9540361678d9f85b5fe96b5df2d96a1796b57226d534069743cd917ef26969a4df06e16799f12124ee5ef18d027475cb15244bc3fb7e90c1ce8ef4851f573861897c538b58489bc9e42409318692668c35e6253ad141341434b3dfe4f1dead129a446ba6ec8a5c0e12ee777df658cede8953c76b22bbc350d2d0e474d33335b7ab9bdb71f376cb67ea895e2cdc033389da61ece46986833a1f1b662532bab7304ec6ceddf6214d28c6c0169172bb67c29c00e81466df16c15332697dd5511edadfe4b1c28dda074aa6f9704df8a244cc9515f1f89b6912a425de5cf861d2ddac110f915301a9ab9172f472dfef156cd9a0a349689d766f6a76c50de8ab8cc1315da3f9af062ac56e867456110e3b9a8a2666d53c5d26cb4185017cfdeeb254181ebe142b9c4dde1d5449396043e51d88aea1ca69d457596fa30ff9467879497f1f122c6e38a92897ac15859f8f40ddf9a3e633487160e8dcb823d10e9d87f279f312881c0e4ea48659d263c94f1b3179018ad0013f90a9ee49cba97f70340d215bcc2e8422eb7924a6636a14d7359bc89eaf22f38ae3c320a8a7dc9b508f052cc25c51211a762bca8b871fbbce0e803d727d9c10feda0ecb62d4d79be0a31cd241220811d52c7dfb6cfe5a985628abb8b2bcd7ba090b296906afb85e710d67af3f43c653952cf7a5451e2528d4ed8776a039a5f290aa98e4f090ff6a45c9fff4949ef3dd33aed29063e6628f94864a0b3b278aa8605672da78d85c47ab524e7c9b9713ce6035c3b2b723bb8b1c61d337881ce93da8830ed918e1d347fe42a4614eb199fe069cd1118c9c581f7a426ea7e3b0608fa84282b396fbfeca987dbd7349d9fcbc2269cc48c62381d3e7f7af893f75496d4014d5f843eb515622a8b0008ff2e269f250c5984d4b58abe3e5ff2245978019f2c3ad47a39ae8896c0f971544e23a8b4c16bda754a1e9532dc70b4b12f79722624e9a607e6b6c018a6b212a81ee14789b4ae821b9ea52cdf4af719636089d2acda88d40cc51632dcb9bd057448e3ecb20d46313e264dc8451b48732112c282fea286716b0bb3357e38c2dc64d6f17ac23ddd35fb507327225bd9c8c057cb36aac5a7025d2dd6437d0a35119ffecfa1872779129c3e91644e9f01ed3929d9fbf2772e9f981141c2d6dfa0df437196feae7542471cd9bc1c25d5b1c4514982a376475f747d68a75039c4b73cc4bdd6f66ba7da10937fd1d0cf63307e3ea1f1649d2fdbb415a331170864c0fbe374390d5bb2e222a317d5b954b40316ea24a6cc6c14bb068983681d1253d650e4471f5b8c32b6b595d393a77ca4a094afb783abbfc34e365db35b076eb10410e6d9b03956116d4f432e224ab2cbbd422a561ef4419453921ed5369c2f201c0cd52648cc01646cd23b436663a6357646f067771b9bee3f50bbbcef02d1366d1599e724d42a615e2f29dd066f15673c99033d980068632a946248ca31315329fddbe0d9e88971a45ed143d65ca508c6c13c6d796f313abe0a7d98c379742419f5e2758e124dc1f182f17a63cf11ae570ae2ded1c009570492502ccf6178c4d5fb0d418655de637166b2e391a1989e646aee3d675dfbd3d5829d18434b85f44af937afddd768fa6a0726515ce3dd2698397db10814968b9f73b1c04c549e7efa170104c386363926d3cf4e0560c1393e548cea4f1adfb45df02555bf3d2f587cd4314f8346d25b87da9896d09987e8aa97073a6f853aa470f18ef84384753dccc642597dbd1a4dedd866d45ff4db8f1241654e27e8f93c38e70ceacbfd249fa7ca9513102cdc06c9b59bd95122df41eb1e4412594bf813076515e09e1f16c879e4b7e58521b516e545320775a97c286d8c5d64b385c21246b123e776b316620d3a09205a2c7c776bfd30ca610995bd983b07a5f88db4d4325d8da4b0e207d38bbbe1d35993fde78cffe2c453f2bc528d9553d877301a8566ce9389270eacceaf0369bddeef8575e572c12f7c92ea87e1842210aad04f969a0318681332c27e05dcaa13b0b68ad8d2bc4c6ddd722a50424b6084a73ace96ada43c779e3f247975021263e1bbc2bac5f06ff6258fa05fd6ba7623b42175ad109c7ecaadd9fd47e48d0b4147cb371cc7130963b298387854b6eae825e9d2d553765ccff17248b1e0f78885a9b31bb0f1cebba09148a2c433578219bfcfef2b3d2768f6e0c0d3e351d1f8f54cb05c65634a93382a50ebd40ba43ad5d9c6b509a8041b68a4a5c9983442b2a631b4ea2fe581f48a4b1ce98ca9fea2813bf51bbcc826b91fcd324002d232222c7922ee12035c3a9414c649436c8ff879d4c1f6287bef47adf58545e54f68762cc001a2bfe337126ae5cc17728fec70e32c1029437f620a85a9f1b7047cc4f9b122f89141198b7d7c3724e11989e8ba7cd3ba0e8e6a23e81ccf5636ff4b508de7d9869d3ffc6087cd1836dd89e463407ac1dd8e983d6308b342ab83eb580d6954fa1c1cdfb537eedaad8aff9580613f1356dd56d79079d456b85016339056bbad6f5c23f8a922c56230b3ab86066de1d8a0896878a017237addc1a01f9965a7055f912b7705d5bd388f67a87e7a590b687a8655cc57f143d7bda08eb79a4dfdb893f314a3e20fd87b5d7f34dcda9a90da8f2af02316f16bc08870bb90573f12b2ad17fce57163ff0b42ac742b2117457c777236f678183cd8b42a8ec22723747d9b8ad7dc6daef6bc5671adb372adcd29b28313e871071f881dfb2f25ad980cca10a9879440b02d6b8f3eae5040846af23fd7ccc49ea7302e5f3ff76cd46abb130fd1a19b8e4de73c0e8ba8c4949e290418f40b030e90eaafdcc5058c8c4e201f694652740afe9385462d32656f7b1e142449b3b6e2cea0010c700905712b75f0c9e0b62893dde6b1c8e2a0597ff1da63e73df2d09ce69963a1542d208918d1c29363442e69100d490a7e2076d90f885b26d43f3b14849f6a118daf8d0b859a5333b2a31ddf6054f570f518e26d843623a165c968193fdec9eda63114d362203a8daadae2f2d292fd082b35efe8d958d1829d43390cd959e0cb168fc6fd1a0c912dd4d899410c5167299ffe996762f94d44509480e088169b62200ae2f52453ffdd9cb2f86a65926ba50688d823501948c02c664fbbfad0fa9dcf41818263b1e4142ee9d021d93c44f4a88264fbcde490d506fa1d8ad5faddc25470f72d0acaea05bab4ef3b21facf7bf3389479fd314d2f928ad2d614833c76fd31af29692d410db68acd42604bd825ee8a92ed2ca749aad86f214c7cf9b508ffe1ecaa0cd8b3e9857def3124b3b29a7ede1184ca9292a022fb819171c44ff48d6979844364827842b4f473025e4df5102330ef4b99f030898a3396b4b60d458729a9382832a57fc45d728adea10e7d982c3882b53ac0c3f6227bf9154c6fbea94ace548fdeb762ad14490eca11e9487494091f0882871883a02f8a84e30e07b75698e6641a8c4158f3768fb803741b96fce47d86fee329cec0c9ead5261bdb6197df173502c760bc11d8b3bb0512a712fb6298c8e028564b2461e95db2f06e826baa886f4b7f1bade267cb8192514f7007e2a4fa347c6d19a325f75aaa17cbaa19e52c86c841f7b727cb82037f127a244d7234945b6c18d97b2975738faa171d5a5ffda940b71a4c73fd6e33b90841b0c3768ad311f0a8f4898c7f1bd390779f0b6b5fa5eafcd9f296057f24f60a7c27f2d9f4a35788cc2bf997c313036bbefe16955c643b63d1e7b21e117d657fefe6e1a89a128c1ae37295fa5824424263aab8b6515377ce2408248b8c065f57eedf2024dedcea058ca1e929cdae342377f801a08fba5cb63abba08090df7954042099c41d1d87bcf10ac00db56e82f11a4cabd0479dc08c8d04b0b29b7cd32f46105080b870068464a3f61eb20c9bd02836d8f87ca5590efc2ee5656d3ac4db906d1cd20d81bd8fd0af2dc2f0e11cf4715a52fd07f8f9111920110d8a89c64f1e53833c3546ce896d5e07e2c552fe1de2bca6d0d5e578709b01aa9c02b1b783529981562ce13a15bd1469fdd369117b5db2a8f08155be17ab5ce4c5ad7aeb4e84b033846991f21a8f63c56d1903616d08aed71c4322e4653f56f93cf80eeb2959489103c104ade63b4008fe9a0b326d7ed1d28bb573c675a06161c71e0cd7ddc042bc3c81e4e618f11f89b5fd505653e45858a467425f624841965c2b2bfc2a339a28f0eb28aa8d3fc4ef373447edbfdb2dc9d2ed50c307814f7d4bec577dff8947852e85815e8482b080a9c8e8eb92d891dea5109728693279ec05e8c4f6e444bc40f801ff2c71919d5e70ea5148cc93e6060337270efee8c325bd7bf456378b6e3fd08306db23dfdaeafbe3b1a5a1b1b6339b71380d2e467f36ba9dcb64a530dd1e3e98b50ecebcbf6393fab4a22606be4309c6776155c2a07c347f66ba60eb65954cebb5d22b304e81db205892b7f99d95600b31d3ead1b62f48719916dc9156200bb09f8efc3fba806eaf88b80247b4a78ead02bbc832ae3e76325413741e41485d5fc6636e6a2aede1e3f19d4f7cccad1be16be0bf0b882409daf45bd37bd7314c47bfcb2b8e42d959702f96ba29"}, &(0x7f0000001480)=0x1008) 03:01:12 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x0, 0x200000000000000, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:12 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x630c, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:13 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0x1000000}], 0x1, 0x0) 03:01:13 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0xfdfdffff}) 03:01:13 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x4004ff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) r3 = getpgid(0x0) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000040)=r3) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r2}, 0x14) [ 171.868828] irq bypass consumer (token 00000000d4e788eb) registration fails: -16 [ 171.880480] binder: release 16404:16406 transaction 462 out, still active [ 171.887498] binder: unexpected work type, 4, not freed [ 171.892816] binder: undelivered TRANSACTION_COMPLETE [ 171.898758] binder: 16404:16406 unknown command 1 [ 171.912617] binder: 16404:16406 ioctl c0306201 20000080 returned -22 03:01:13 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:13 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}) 03:01:13 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x3, 0x1, r2}) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x200, 0x0) ioctl$FIDEDUPERANGE(r3, 0xc0189436, &(0x7f00000002c0)={0x4, 0xa46, 0x2, 0x0, 0x0, [{r3, 0x0, 0x7a25a652}, {r1}]}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYPTR=&(0x7f0000000140)=ANY=[@ANYRESOCT]]) getsockopt$bt_BT_POWER(r3, 0x112, 0x9, &(0x7f0000000100), &(0x7f00000001c0)=0x1) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) socket$packet(0x11, 0x3, 0x300) r4 = eventfd(0x9) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r4}) setsockopt$inet6_MCAST_LEAVE_GROUP(r3, 0x29, 0x2d, &(0x7f0000000200)={0x7b9, {{0xa, 0x4e20, 0x80000000, @mcast2={0xff, 0x2, [], 0x1}, 0x685d8cc8}}}, 0x88) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r4}) 03:01:13 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x8000, 0x0) setsockopt$inet_tcp_buf(r2, 0x6, 0x1d, &(0x7f0000000240)="1f6defab3dbaa8e5a5df71b13053dbd3a282e3cb923850534ca927e695d266d716085fa9303438a83c05e76fea324bcdf11fbeeb32688bb964924614fee6506076aa56e3da52fc954d604b31ae46243b8d9efd55b41a77449eccc6e7253ac34c37620676391705777971d300f678b6f492e9bb1a5c782aa2043dadf16d67637b6389687273f3d394cac2b15b1c5be4f2a600", 0x92) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000300)=0x0) capset(&(0x7f0000000340)={0x20080522, r3}, &(0x7f0000000380)={0x7, 0x81, 0x10000000000, 0x1, 0x4, 0xe4f}) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x204000, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000040)={0x0, 0x5babb8d7, 0x10, 0x7fffffff, 0x6}, &(0x7f0000000080)=0x18) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r4, 0x84, 0x20, &(0x7f0000000140)=0x4, 0x4) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x66, &(0x7f00000000c0)={r5, 0xfffffffffffffff7}, &(0x7f0000000100)=0x8) pivot_root(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') [ 171.970888] binder_alloc: binder_alloc_mmap_handler: 16404 20001000-20004000 already mapped failed -16 [ 172.000815] binder: BINDER_SET_CONTEXT_MGR already set 03:01:13 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0xc0ffffff}], 0x1, 0x0) 03:01:13 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff}) [ 172.051169] binder: 16404:16406 ioctl 40046207 0 returned -16 03:01:13 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x1000000000000]}) 03:01:13 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x0, 0xff030000, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:13 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:13 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000080), &(0x7f00000000c0)=0x8) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x400, 0x0) ioctl$SG_GET_ACCESS_COUNT(r1, 0x2289, &(0x7f0000000040)) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r2}, 0x14) 03:01:13 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x10001, 0x80) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000080)={0x8001, 0x1, 0xfffffffffffffff7, 0x89e}, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000480)=0x5) ioctl$KVM_IRQ_LINE_STATUS(r0, 0xc008ae67, &(0x7f00000004c0)={0x8}) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000015c0)={r3}) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000180)={r4}) execve(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000300)=[&(0x7f0000000100)='/dev/kvm\x00', &(0x7f0000000140)='posix_acl_accessbdeveth1]vmnet0}ppp0-#%vmnet0selinux\x00', &(0x7f00000001c0)='#.+wlan0&:-:ppp0^lo\x00', &(0x7f0000000200)='\x00', &(0x7f0000000240)='/dev/kvm\x00', &(0x7f0000000280)='#&&\x00', &(0x7f00000002c0)='/dev/dsp#\x00'], &(0x7f0000000440)=[&(0x7f0000000340)='/dev/kvm\x00', &(0x7f00000003c0)="3a73656c696e75781800", &(0x7f0000000400)='/dev/kvm\x00']) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000040)={r4}) [ 172.098479] binder_alloc: 16404: binder_alloc_buf, no vma [ 172.104205] binder: 16404:16456 transaction failed 29189/-3, size 24-8 line 2967 [ 172.127830] binder: 16404:16430 unknown command 1 [ 172.153156] binder: undelivered TRANSACTION_ERROR: 29189 [ 172.159581] binder: 16404:16430 ioctl c0306201 20000080 returned -22 03:01:13 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40406301, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:13 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0xffffffff00000000}], 0x1, 0x0) [ 172.208059] binder: send failed reply for transaction 462, target dead 03:01:13 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd}) 03:01:13 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', r1}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r2}, 0x14) 03:01:13 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000]}) 03:01:13 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:13 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000000)={0x104001, 0x102000}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:13 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0x900}], 0x1, 0x0) 03:01:13 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f0000000080)=@buf={0x6c, &(0x7f0000000000)="c5830031da66f78f8a4ab16aea0cef8f1c211ae3985867bb8e0c0ac4132acf18c96360864da23f6d18e2373b3e815e7d00f4a411ea8c1946e1496e7750d370f1b24c85b83958a54376dc4c90f5b149bea1330e38d5d0f2a50654200cb95bdf7b8d4791177c259a1a56e315be"}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) 03:01:13 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x0, 0xe8030000, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:13 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000}) 03:01:13 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)="3970d7", 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:13 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]}) 03:01:13 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl(r1, 0xfffffffffffffffa, &(0x7f00000003c0)="48faf344cb4075faf323d21f5b2686f7d5a7513b195935f6bdc25a80978926d18261ea9a2720cac61f372eb7dbf6fc6316e4dccc0dec28d0fbe9fe7c6a7064388a8b7084d95ee70f1d1dedfd1ac83d4f1ae312df8a407d995d66eccc8aa7b1b5dfe6c1584f55bc55b4e97cae3dbab0324e284121e8ed0b8f79f5a3932cfa26a6edb33550789187c74b6173c8627850c4be45865d998b99c505d9dc48dc581eda807c2a3689313752bcb4f59ef6395a9e2a23c4c127db3d5d685b715b8cf0f0ad525bb1700af56c0f324a11c7f421345a305e54530240ca7cc7e6c6d3c760fa3958580247719550b8588ef59b9e91b79961b83603c10830c047b3d68f1cb12be0994fcd2327264c1d851594662bfa6ab07fb8e20bbda9db210cd367a29081edb8c188c52f4ae4a7249119919aa2973977e72f366f0a4bf0c0052c73901b5d48f0d9851000d79074a6a36344586d6d2bb22a138e7d4c95dbd88d2904f542c84085dbf18e01ea921c5c0140aef826ae0d31349a4ed79af16b198f11f1f7d36f834d4f4e099f07df8f845e5ea5ebae35005defe6111f45a5aff11a829e9549dc2e4f5e32294dc3e8128f833882d9b79461839e8948f34ba3d970a72b183d5673c901e5ae57a6b1139a7ee315198f3cd60df184ed6c16c5b3517e1e55609ceb0dbb5921a9f7d643f76a785b2a539aba635a091ffb790bef38cb8df716997df405d0cfe5656d3f038188c3f707b2eb77f369a29f464fc5ef1187c96fbcd62278f5da3d81cb891ee5d703ac4c846e0c5e673d00d6410e0e3da731d134850618d5612d4bd32faff6c6309d0927dd508c83d401a794ed8339649d9269d4fd83a3f9121873ad1e585abec190cefb5f495f1cc9bf162c2c2ca75a1f89da1e5bc046814c7f8f921e3476f765b78a50bdc9ccedcfd39a322c1a178c2fb08a6d5ddb105c136e8ae95f6bea7e2db4cd0e077fb95e872c48327011b48e40826ff56f040d816949416a60e1974808f88e5a23da55f807a6182926cf4093bda3137487a9468a637cfba5b93ee5a84d7a9cdf911ec3143bd2799fa8069162ddbd705137722ff2d83ddb854931033d278b8842ecb48fb64ea4faf3a927941b41dff01f69623fdb67a0bbfd51b659ba5c20ba148084cb43ac4f0b9cd61e8c5fb054cb921357366c58a09559d98980a38d608a5f2920a5aa8cfa8e030a3270fef6f1e5bcfd6d6d3eafb59bf66211ab5fb1ba187e6963af9d63c2972c8f2916039ae39ca16202dae10a82819ff15c768c02441af3b0f662debbc367bec98d3fc1e825bdb7c44ee42a36bfac1f432df2a700d553edb2b5487d87c6989e78ddb77f590542f713fdc2819e0c073ac172fc47aa9c83afa4682bbc8f9b7edbb9377c89b32188a04b1aadc57b55f66633c6d720224101721973587b8ac06ce1b6d9838a573e941f7e27689f438b30abc9f5ca79746d40a9d4112ac4545cdc64ce3c7da6179732b35a2a0b02804f89a94b50d9a8b5c0c30538f89f15e95925a969687c0d0cda3e0f741c6fd8fe0671b494ac6283ca28b0f5e5ad1199c661c091d2e578b86f1b57a0f8a715ab7a5ce0f4704936f186bae8ec6fe8e461a75154e1452800bce67a29d4558bdca478a14463b6ad0fee06462f21106f60411e0a58c2adff9a1ebdd378a0fac9cbc40b0797966ebf546f5ef14d9b0851d1b92bdd549aa37c918f3a6aaa507155ae5a96fb73b7f6d29b790f2801a240721a8b41b539336769cd1bd085bbdf6febe9773b1e2e9c102f2fe2403e71456917077d98158822814a5206d0adaf5e4d29cf6be914aacb4ca058b13f244d9b9e3785efcb8cbea1bd7d830afce362b0aee193930e95c63d466685859ea5f2568eaf2212a99879b0788be3964bc9344aaf7e820292e5fedfe74f10c987a9bad02e3831abab77a619bb250f40403a7ae768159fead7a1e70ac2d5229f43f85d4455885d634f7550891c056477d077da514faec44c02634fa6979fe35cdca08eaa5921ce88f4833d1a82420cc042d2d9437946dbb8e2b464314c2ea3287e4733a2c19f7358bf9a0aa1c9debd4b6144ae4b087590806ec6d4b7ab4edb424a52e913b421f3121d2e2702e00dd5355cacc964a41a54240dc2542a90def5cf60eb786bd5d2c9a53ba2ddf72a4ff01707fef636944e413e3d4535cb4f73f253dc239b611495a7563182b322a90420b2b6811b609960b924fcd3c77f14b9c42ea77f920718d99d222e8c717f75c2ef38a626453e713c759e689fffad764fab06d74d3b4dbd07fa0cc2fec6b5b96bd967081bc839f797d87537db236f0f859f83ad80e44ef992d9f346b406b547407b393776acb76f608bdeb3d81e9bd9f5ad1a37937d124aeec3aea5270db80e13acef371bb003c7c9f9cd8f6538d1c7e4c5d6e8f2c8bef08adfa11aa2453617c4e61343d6e82c49d64beeb49f8e7bea00d0440649301d33edd737d2c3a71adfac0ac2bd74273e9f90c66bb46191ddb0effbdc7c8ccdd9d3045c732f6685012a2afcb3a3d88b7334a196d5acd2394bb67ebf4f095599fe8865076d1b92dfd848e1032cbd86740cb7c3f03e51a439aaf4447d2fdab8235cd3b3ecfbd935072ee8e1d594b4625f02f20251d9405c2882afa4a53077186caf5679b90eb4f0c280f7c9567cb387ac89778d72e4216cca1355111d188c55b767717d87a401f57de1ed92909b67103092308c26e8890cf14c1cccc51adf2acc3a67917334772d889727bd8bf9e36cde2c91ccf05694a307f5071fdd3499f2ecdf3cf874a545367ef4f6d625051163da30d49075b74301ad080c39642a0ba01b3eb4a73a9a630529ab814f78a1bce09b80ccf839d99b216a3fb9c208e7634c1e80606d19baeff27c131fbcaf3daf55cf4620aebd3f279398d130ce527bfad77a4c13a8f9566fb774032a74ca2093b7a0a27418e67533ef498b2624234d7fa699292eaad50e6c79a71ab7ca7adadca31cc77727d7fabe2d60970ddeb1357f2cce35d5bca88d7c1e5453d1a0bbac2f6d4f00fd98b7f653e9bb12f4ea1c329f4fe8c01f1fe3a467d48e731875c3d499a8b651c82ba18377c875919ab1c1371bfa17496ccdae5474fb8c660f0c056c4124693d76dc30dcd476daffe7d2c463461fba9c338cd9b3545a58c061e187e550612be476146eac8068a58d7a965ad286f5b1d4c3ae84bb6b4ab7f44887729ca0b7578a9e3f85ee7282a102a02f69b03539f3e66e90a7de01a8da785366b24003144fe549593ba91f27c443f8e59398307713c0d10050d7e26cc9af9616e29552e303c4235e96aef5fe335f03fbb9d06ac4d5d48f4b50b939db0a293731e7e0c2a6e538baf4168a70fe56570ab2a6f667aa7defccd39a0660442f8ac10991550d0ba002d66c915460b66a0bd291efc502c86bd7660505d28833c204f3f717dab8145ca083105d3549a07e83b795a59d8cbc048904b4267bb97ef75e736f4675997afc0a4bbda7efb19d7d3c0bb43c7c85add4bfb62feae4cc97f6d2c83d4f77eaf2a83129a670fa201e6eaed17ef9143b07c89c61fdb86fa1fe4993200a31c1e2b788e161e9960dc85d96d3c00ea252c76df1bf1c1274fc1bfb19c8c02c284d1c136585b35fe63b82089de298309a4b32eff38cdebefe80df9e1bbb1a1deba5fc0ba7e85047b793d98f75d5e8fb41ed366d21b86b5ef8f9b41ea9b5ae7c9d75b10644a1cdc824ebdaa31ac3ec40194a2ce02745a6d4ae057cec127614baf0554b37f19e9d8913c299f8155f5914858c2c8858b3aad0c2010cd4b9957f9cb2837da26ae0ef4d7b39c2d2bfe92817459680523e8a4b591ec9aef0bb364d32708241a8847bb0dcaee5a81915043c24a5c6a267afd2c7f34a230e06f04fdcc6616be9d5aed2576e263ecd88a9ebbce570efc6d3b3c7510d4ad7cfaf928624945293bcf15990c703812f38168fe444e2414cbbfa00f4af103e0a0855c4a5dfc57be37730ab689c4cee4973f5fa019b848f6f6dd6b099118c123b96dac8ffc31f16eaad5ed469a04c6a7fe8852c955174f0729aaddf6a96d40222de9083bd5d5b98e2a58ef7c0f8f14c6b7c552149e4182cd2afa4ecb33174a62693b51c6d2a9e801c5e7cc5719fe27dcd2c41300b5ca75321cd5ff7c29eed61f52f63a8ac763baad770304c7b11417fb8ff4033bd90396d1c485276f92b3f06b414ccfbf61a0ff8073d658bf87e61e38fc80548c5e8f328d72cbf97514f4be30f29d8a4d70ece79b2d1436a863e5948aad97811c2e0cc8c633455ac15d75d40af72908c9de2d3bf2803227336d8ae4393784e32491cca32de50c17a5d45ee7e3aad2f7402548b58dbc6b8044cb25600efa88691cf5a1c4201914bef62988730bbe06ac8c33feafc7a611508d93f8187325a0589997dbd3351f276fa356758bc0c7d32184ca08236d229238f41542de2cb80746344cc00ad5f50974d13d36ded6866961de1760c6548e615299f1217b0282e3197b49ec4eab30c5208a4309d625d6c48fc4a28474c4f2c7447480955813a85a43991a8b729e04491e8b8d9093b33d6a8f5e1392daf1e238df443c2502be1572f90e836345a24e764aa32cc2c66607cda7c5c7fd849740e1d5d35db630e7c073f37fdeb935ba63b29f61556015a557f920e905f924f09069e369c62529603823179b5b4286a3f7b41adbf8ff678f18433847f7c8d4c7386d53c2b39f3d32753c234b127f951fb43768acb3ffd790ef598d56e95bb872cd6401d47d0bfc6fe438a5584a8afd9c34d15dd59e7895957e2ec8cae2ed050f0434b06c239e888f4230d165d2fe1cef1cc2a173f519238eb20441a430947e3248ffbffe95fc2b6605d6097b866057cd21f96ae3a2c25524603f6305bd4b4af9711e0bca9f09b1d4be298de4dbf19b9e7fd0cdfde1d0c785fca096297ec409ace6e3b51e1a92674b788f8f2d9fa65005ec20f4025b86876bf97739dba86b751b9a1add649144afa93a1ace5d803d2fa16d306e0fb223c593de0b0ecae39966acbd688a50756d5b95995b24f9fcaccaf985b7c9862db6907abcf7e2894c5ac2fa7a5063a2b20738640f7ccf86c73a46479331e268c771c03fdfff79a4280a1ac233eaefcc92588a85387075bb53a221fbc828255f5a4116f388ed027385868d7dde6c14bb5072a1dd1a51436a97861aea1b1bea94cb1b722352498106ae887bd95aad176ca965182e071b213745f4c4874707f5e98708f7d96ca2524d6a36280dee82770edbcb458ad4c8d90ae190706a20d0c162302ada79b7efbe57ecff5ebe30a8d4d340bffd7f8d42e4d2e979a9fea66bc4f244e968edb4da5d968e660ade673ecaf533d6891a5f02f283b7f716a5d0baa5206e776a767db9df70e205021268b1b4eea50a477dee11a4194656276af5cbe407f1191088f028b9489cd79ebd2254fc05bb2064b5fda5f665ec820d1170c5038065887d4021a74287845bd187397905301f085990b3d37f585d5db47e74c34c352ca7fdd27e69597ba488a2b255bb81eb8483b14f16a0785dc60c2a8521e9380dbac801ca2052a94b236c5d43576eeeae24085df76f8584a37643a83010b349db6c7105f77784620a930e7781eb48ec62f57368dc02120aacd857c25cef3c6805777160b3a99d83bbf7e6af849ed14cf4f0c8aa1cba9945814609ee7b80d22cc9fc643eaf83cee7157757abf2ee665a6aee704f7ec3ce45e406e6233cc7d2127dc7890af959b218afcef2f097c3ec75342a105c289ffb9ebb727da371f336bf96bf6c80442e744b12ed40031e5eaae9fe9a586489088f564") ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:13 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) getrusage(0xffffffffffffffff, &(0x7f0000000000)) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) 03:01:13 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0xfd}], 0x1, 0x0) [ 172.465858] binder: release 16486:16515 transaction 467 out, still active [ 172.472885] binder: unexpected work type, 4, not freed [ 172.478184] binder: undelivered TRANSACTION_COMPLETE [ 172.483661] binder: 16486:16515 got reply transaction with no transaction stack [ 172.491245] binder: 16486:16515 transaction failed 29201/-71, size 0-0 line 2759 [ 172.582469] binder_alloc: binder_alloc_mmap_handler: 16486 20001000-20004000 already mapped failed -16 [ 172.626123] binder: BINDER_SET_CONTEXT_MGR already set [ 172.636993] binder: 16486:16515 ioctl 40046207 0 returned -16 [ 172.644978] binder_alloc: 16486: binder_alloc_buf, no vma [ 172.650646] binder: 16486:16554 transaction failed 29189/-3, size 24-8 line 2967 03:01:13 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40086310, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:13 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd}) 03:01:13 executing program 1: syz_mount_image$gfs2(&(0x7f0000000000)='gfs2\x00', &(0x7f0000000040)='./file0\x00', 0x8, 0x5, &(0x7f0000002300)=[{&(0x7f0000000080)="e20ea0b69c0c15ef99c59dff90ffa682c80f1e5a0a1c5ea363a16a5cb5efdaaa191b13d98ae917da", 0x28, 0x8f3}, {&(0x7f0000000240)="91a9c832a2bdf14e024b50872938f818a13989f78f241e82ce7cb321b31eebc4091ac7a3d052a46fbc605ec6a4c6eeaf7288fa319677bf59231e52b4a94ab17409a33d23b9002b6618930b77e41d48b980d3cd2c2f3623b1fa8a09d69fc2afa28d23d67072aa8d638c78509ef57898f2fedf507368dc67fc112a9997f26529eb88f91e4a7ece73c143820ef580b75fbc66c50cde6a286c628b13b4368397ffec10cc6523d4347d39dacbdd0369b2d5a8ba0c5604739dcf1ee46f197d49e7d25e58ef39ed5c27f04c07f26b25a8eb92716c0756eed7428c740738ae7815120b28d88756aa2ef6d10af63ec8a1943d5373367781d66da5c615d6953ef180b28c063676f7cc31ea3f9fd8f8100da9fa82ba06035c3ded1f39ccfa89aa500d3a476b1b8fde13ae64a6dd6b0e451f8f666256fbcd5312311d34812edf64f4c3b2587f3e5e9136246f9090b05b8b3243dd773a2c623448736e659c8749e232aeceaff2868075bfc935b7a60cad101fff185f10e0322f723124b8cf102988eb0ea3966f254a9da5dc35568368d6ae9ac9cccb207b1243d0b469db635060a329d91810c678f4d116a27e533b7b557714bdd0393e5928af9d5f13b6dbb7dbbf8115543feeef9c56c57bc4713f1097bb9f35823f78a1cfcc867e52d83a0aa926795d7dbb8517735b77fb909d6bef947f40909237a5432f6a6c697d9e345c4044e83028fa7a79d973744ea9b0e333bd91c478ae5c351be7467fbf273d1792b9022ed933414f4da8a33dc2eaed5a75fb264b88361c560cd12ceb289efe6c7a6a9f44c6112e727556d77071d481d6eb8a9554ce6ecc749218e97a4efe3ba604f313a10ecaac09e3f495d70565bd67e7d8d10c6ba6e6512c0f7804e3e7b78623c0cec43debdd682ba7d5ffc5d593752f6eef2cb2fd5208f81f7c331d9b8f7aa1bb8a57e47b40d4c4b836fdd1e0d0f3f65cd8874621d1919a4621014dc62f4ec6852b16d76c73c7622f992147ed7643540879b5f9ad473dce3f0fbfa1e2c0826aaa2fad045e6ec771c0194a54f1131cbc189ea631bc3a214a2351c6a067f3297ea3cb03d78f7e4872a9533fa1e7b679003944ad9b05d1b587d0dee7121dc794524d3adaab4a0cb52455d5a2a7b073450afedeaa196ba5ae56a4977a7f4e5ef49324733c5d935ff5dd637c5be2faa8f4ab430b33821a8465e9f72c441637ea576c2a7c15075b7402eb8ae41a648e9e139f1400bc9c9184b30c403182f63f32b7f19128de46b31202e10a2327698ac5239468e05d2aa041d9357fba071dfa56c2549463b3df0b7d91678956a0a3ad2b3fd52dedcd355cb56c37f901a96c367c573dd98e8656f61458121005ea36046c3cfbd6a52b2f367d54f991a1ca4500bc866cdcf388598f1d6c876be5ecf5f86529581844f87acf7fe9d9b591ceb43055637c604178bf4283b3161c3af444f4a36f7ff5b888d411ced8702146b25357c26e54bfbb5902daf4c051dd9559ab835dd82b0eec705deac3ae84f0db53f47feb7eee30773c28d5f1bd21b11b930a1dba4e89136403ce9439a32448d0e6d8802e0534ef2b3c5c7c94fe3f5d6c7aeec61a1e15fdeef4c3639090ea310aa442a2a630cda243daefdee0d25baf7df46ce39aa7b217dcb01462091fd40df54bc667f7408e33ada66f5912b6300cf02bdb9fd0424ceae93121ac7f0fa95004a49ede543033e9cffc98e2659961ccd0060f299e642f0ee5fa2d3d4740678a15e9d2ee8b90fdca9be2160d9ea9fccf91679fd975ecf55b09a685ac98158c039f0287847307e4e36f2974baa443a210b263af84244bbf54e8889991d31efa371e87ba744269f5aa0c8ff447d930070a428ea0c99a1776ce75b4074917c200619c363c6c05c7825abcf0cecbb1346f9e3b3045079ca8968dd7a8f963f63ce17278bbfafe4738f254163b934cdcab4c778871cd8ffa2e3e799cc6412d311bce1d447e98b55b6d6b50d8993fd019b5e6bfd3b155b5e8b02fab4c5d46958d3676f329fd43cbd72dcb25533a447458e7835069d7466f5ca28399672fc0f3befbad5c510663c6f63d6cc9fff08d96ae6b998e6a69323cf2f44434a56b8d1d9572d9934fc74641e08ff657ed2bad403f284b8bb27e7397111ff8de28c68257e7d428b6d6af61f59bca80580ee9b1023dff9fe2a342b0b3c44934d2b1a5862927dc3da4b91f992bdb61244edb3e7eade9e52fff21548c26b13e409ad63cc6719cd3c2a9d4878e5c5007f46a56cf4424b69f2de54d912fa2965ee0c65336c04eb58be9016cef609a6b1808d80597ea7c160d581b67bcaf9d6dc62dabdcea4d61254dcc932adbc990fd4feef9d29fa135ee82f86376ef01f58e877c58c03583027f9da5c113c8314134d7e1a6e874323752afe89286341afd1a6140302922cf7d177c2f5337425874749191afd6c3ac55f1fd581ad73fcc7ee40c3a5abdc3541d27989ca432ac0cd96dbf96880f954a6df0f1215787bbaae0e992a7d307028eb65f133641d778e66ad79f53a585971f950e17e118e2b24e3238e8b4698a30953112e650a387422105e3f83203ce4987ecc388a80daac94938900b700a48087bc6ee517044e9f44217b7ae08db7cec49651a98a25310746104484662fd10dc7bdc3a42a3cde8d516a2a97b4150f0c8f16491589b9c641b7384e62b6df0619f28be9b104477a32131f20763713a3bd13226912c570f22caa464a7731d64aedae8b9f8eee4959ab35c07bd10e238498f013537ee3ce1f158d0cde9ca64b94fe1d829733322604e813362360db5576bbc6fac2964f4b7c504d153a2b30a2e7617f1dd70c01a9c9870f528eb505d12f4fd946dd20d5870558862f4899c6be2e5552ad7a466e44b54cb87820eb5b8fb0d4b76e69de364a0191de7420c5a39bbd5458bdd90bc74331f4578456fa4b1b45a17c7439dac74ba0cba7e13f9282cd76f5c671c5e9d1cf7d4f00a29c787635d35f548bbee3adc22c35c8b5437af8d31a1ff443139434f7902726afdcfc99f71e6c2dfb8dcd925460f9989daebde4df2f576f21940cffc55bcfe474fe60a79482fdf4d12a4ca1066cb3048e23047fd47760143cffa53d62c97b127f56b9bdd7433f2fe9e5826d43127c956f2659dd7356f0addb7c121efa8d052f33be5f2a36a503a5eee36cc4f891dfe1ea02963b89241b91d94f9f6f71f928e95cfa290adddcd174ddf606923918c996584af67a81e487700130b78cf6b3986c996cb6b435357188c7d868cf96b806fc8a2e34ee5e21ddcc98d63cd369be272915bd39e0a0f7f819b7ddbe9d64c73ecc45c52a9ff6f78ae35efdc3950a7671993ecd38fb13b6db9ca570d7ff4a3b37fd1f4bc6e5a6a5fc3aca8ce257bb39aa9c762f48b5512c8c19452491b5c322b51a4a2e5843329a27cf4f29e2c7cad89309e6cd21ee21c3c7c62b5a2e9dca71f0536d85a5614c151aba63b63140ff95a0e48ff9139237a33bf665e679ca7e7a0f8b56f3cce99ee51aecf38e1fbf3bd073d6b006da6edc7fe606e6f105dbe53c444d6d96653e2040979f8f9ff7b43f2aa4ef025039a9df36474dfafc151051aea37f23d43c0f45bb7b6d145cd44ffbd45e8a1239491a0f2ad4aad37014759c0c30953b361302492352f41ffb1a8ed47ecb3d2ffaf99a6519f8c88f3f25885fba0b4c5330edecc8027705f0b3df6866fbc6914afacafbcf36c0c1b07fc34aaa630c90d1d893f72969198916ebef2cb496f3b02dfa9756968b6d6aa4a8b32c595d081ecd4bd2d472b58549f250fbd4e7b78a396134797388d416abf919e13e7896708449795fff55178a499c052bee1b1982a2ffd5fbdb44ab7996694763f37d256e5637faf1e6ac47978f1a0a2b716aa590af58439db4080b03066ac1207420356901757debb99e33df079af3e0db27a520c93bce4df9b12e4568b9dc40fe10f22f330206d01e214f5a743d903987d9ccb112d5dd82135274eb655296ca27626879bdb06c06cc70ffc8b016e59f1f02913b64539a5059b75cd931e77cc00320a450b53fb62682ce70abd2082e9e977178a358468c4bbbb99987450c0756188120822edc31755cd056b6c1f267fcb9fe32cf95fd988cc93caaf1d1618fbb75e4bb838dee62e8f58874580630e17c2cea80761ddc072c73dc6acf3d17a0ee60ac1673c00e8bc4606b13b76599bcbefba4ea2fbf41827473a630b42fba74046629531691eec6cba28130e634234baf1f3d17c1e48570b043033860eca3abbfeea41fbfdaddb086d05e2fca42304d88eb4cc34f5fde975c1d7d65fa0a51b981bb4d17f88e4ee13f8a1ecbd8a92eeb1d3093c1e6af2c259907b16d35b05ab76ab7f1e958181692c720f87d61eee36255f5f7e63f29b48adae34c56f6bfa12cb1744b46ee98fab8d880aa4eec68c1df30ff2dc5836315795005c905ce96de2d3ef04624f7c72c729b917724f69ba1e04741ecdfbaa458255b7487a4f18a4216ed88c62ec80adc109ac5fc8f9f01dc7c1e8ff4afe8b378e7fd4e0f813ce7355669cbe6e5dcd95ec9e3f4764370cff0f719555c62a7cecac98793a73bd577e56d07595eb17b0187d5799ddccfb9db1b99a0b90d1d03349c861d622dfeab8adce677f86c35369f20584522f89872533daf8097a62e49210f47241fb464dbb35c218c0181cd4788d93e86b134f7af960f7d97acd4dfbaf8643acc7435986231f082ee8a6602281eaa1e1c455f48ec5fca8628c55d9298b06bb446cf2c0b73cca003e6862b60e7b4a7a03479172b5e91a381f7e9196c001a6738b299aeefb7963512dd41f15cf89569e59781451389fc3707a518ccf737dda4be95fe16528a59326c07b9ba668d7b006ee1cc745065187fd125e029f1931ba52c6a4222c5b1868e9c7f3f3455552869af6acbceab534505d3fdeb449a4e1365aa75ad8dfd987cc7470f9a75ee8173f0302657ea6e0dc7efd226f59c2e47789a049ea638ce911b5ad71f8564909ae197757ba5d68604dc6c59135288e25312965ccc219dc7c599f42c002cbe29ee47bcd3b79f237bda65700b1d30ebb17c890b4da23cf1e9276a0a13e3c0ffeb71a9bf2fed4db51bcc958d9fa21ba227f6ad8f6a612f7db0359ffb7a64dce51d6d6670f28494fee64db41a38ff23497ac0b65c03bdb1ef1125b05b354d350111fa5f0b96c2d1657798e68152437113d80c24cb02ed48ee8ad3e4b3a1bf9702151f4e606bdf8e6b78417dbb88620f9ff99041f5eb423e237b00063531556137089a9dd47dad04910f3e8355bf9b9cf4c7b87aa1c9b523c18d42216244c444004c516a95f14bfcc284993a6d1e98fc6a3082e9994bb4be0cebf85fdecd6aed246429138934da9b25d7d07d97696714255d4413d994c37b27136d4a32d624fa4855bba1dc8a4142650e87b6811d715c8f55e8a91144776edb08e3bfc277647be266b2f46e84eb8efcbbc44303aaccf0ddf3200e2fdc921b4c50a6a97bf5981e40e8c72705d49d59b7f003633f7c121afb3e4e7cbd95023909caa9a9d5963a80e080f399f4e2b4e2b98ea7353df2d21214cc0a5e99c81b0869c7b999697fdcb9833be6a632d7583c91dada9e6aec771d39aad57af2b73afb89ef44e181921e9d7087ae37f23a546959820cb3983d2a6edd4722f1d697075bf458a5639633018cf9fd5d1250394b0a474b898939176d814b381a06292bff525f5cddcba674c84352f7ab83488b18290e6204682104bd94eeb78fde4ff3870d60e75e6f1a06989b698a75adb3345082268a58631e30b169848679215c5227df400d8b4f0d90a7f", 0x1000, 0x200}, {&(0x7f00000000c0)="1ccd8d0c381e97cf09a29df5d090d2b245d9dd71f1a1330318178e4b783ab726891413d12f28f58210093fb6d73c1f62b217d9a079f4f98d034e9860b50753435a4d42019b4e2c726326d1a0ee7972fa6dbd0f8b14911b3d1fd8665c98e7705c014365d47291b8b8ee179e97610a3f6d5ecc76ad618cfb96c2aa711466d875c29e1d7935f2a80c56808314e0a3bafec337a8f3267e8d5722b80d7962e98a9686cd38d3f36b5e9a41554f61228254d7239851b203d3af8ae6fa65a867a71f8ba5ada90da99541", 0xc6, 0x2}, {&(0x7f0000001240)="17e8ab94b940e7849a97675e4ad7955544becf8280c9f6ab41ea5a39d5311f517676868221f68abcaa7d284b1b5e5f10f22984efa63d947f86d968d0237cdfa7324adf5a95db528bf90fcd69154c34d6891e398410c2e1b6e888127558ec58cbe5c4716a98bfe8b7ff91789a076cc45c7f7c5046b39a9242b1510ac28261d82a74fd7d40f4e9883f291196ea98cf5517883c3162c529023fc6c160281c52d84959610825220cadfd94cc139dc67a890ef4aadfdaed5f03aaa423adaa49a7913ceeb7fb055e48b7168f56501b5f90bcb32ecf092a5c221b4705acaf786f79b262fe6b3a1d2348d26a8a6929337514bac54ff7d7a04046fb98b19a205e80a7bd58931bcf4443a1f825c3b72a5e4efeb2b3bebc2f412dda0b20076c3e5432bc07b2bfb5338fc70b20300f720329d9ab0345550b262af7d98e1e4d21563cff9cffc1a2b11ea9e5731a4ee6d25d9e009e35132fe4cc7040b522d59b44e91b558d4a19d5c28e0f9285a8d2565211c80e004733ff2bcc93d23e451a9b0aa810e26efed922a2fa45468c4f821bbbd17e7390ff67beeec39a0e81f6c15ec0e19f8d35c526a85bef763ca29bf4e1f9c4793fab9e50831088913935dedd25894e23a70630614b140c92f2c6ff7c9e9eb0b1f8e107474442fb5653a14a5364bbc8b4413030ab2ca1c977e76bae2fd820e9cf50d5d54a496fc83c60891c44fb4322184a13ab1bcf8f65366db7f45d25ac30e308f1bb243008dd6e61bcd6eacdcf0daae262de556ebd8067e921008aae5e8ef762ac1ff13c563c00c89bfe8c8faab359793bcd86992c2ebf7caadd62cdd80750a1a704a7e12e56cc52f21daf8f6d19e06c34384cfcdb7986b02839bc6d02a333f3eae38ed7a5440fd98931eabdb08ce7fa2e52beaa85aeee8a5dfaf097c356c36f427ff002a691a082da0bd55c848cf4fa533732b19e485876610cefd12b29f7ecc20c4e44e1dfff391d58837cf46f1d6698778315f57b205022ecdd6f9e23568f6c63afdd9c5bbf2d8509b1cea9603312d10b7b45c283f03fdce17364faa660839748b9e85d038fa0eaab75f039490621291f2eab5294ea480d86b0110fe0e892d422a0c5af6a529570619980d3577a8a9a2eaadc2b0d3cb619d266401eea6c3a9f150d2477e7dc8a056806375dd6fd71140e1e5c77735f499a0589f5b9dd296e33011d7e70cd6f0678438ffcee3688f75fff97c2b172996d4a18e166bacc68de1fe7f7092c1ca661bc484028ac57d6f0fb9da2440b340c1af9b9405cc0da6593fd73a7c9d1b0a5c7197b4811edff55606f0422a1215077149c29f1a8b9238c92306766177e0e890e9837a834ba477f8536dbe210d3f17285e2efafd68ebd7e1dadcb77afe2894d5e963c88e717af06c58d458551d7e1a14c7c08256c9f27d4c31239ca69095c9171359e3f34469a349648bdf014d7d43f323bde8c6fb5b388b2bf79a33f34e3ce2027ebac3a603288efc3356db5d2425c1895ed00373185505b91e172ecd78261dd016d372108d22c9d6b4a42aeeeeecf4838344126212c26d3465f588d24b3d3e966df01cc18d1273c1a4fd0ade3a73a26fad5693c2dd13e7ab3832f9fa01fd4564435e6b07364aecbbd7455b4899306c86247f79eb7a4b98210ecdaf8800cfda7198548ea101a53a161830cd4f8902d4fa57b4920193da1fd6516e650f8eda36a314cb95ec29a90c0cb7c64429005bfb14755a5aad8ee3b6968c5b38755e2cafcb6ccad606275b7ac706b76fd5dd013ab5986d44b3edb1e49447e482ce378637c575264a9f8942228fa44ea69b162d2f37e246f6b5e3d87f6a29702d2f4d60d5d8bbf5b80ded319212a438e98bb5434f10d045a4a5eb7c1f45273130910926fe12246bba998649821670d27356fc7c13dbf75d232c86856c3e625329fb27e8fb9f3ae257b6f284e4ff3750aab220ffce16f16f010ad0063fb5fba158017353dab8893563c93a75cd8a95d5f5baddcd6ee29aa75049be09f4de1ca99cd9b651d0b30687e5475b515ce912e49516ce05597aca37b01c7398887a27e017da16797a69234783857a23500fcfcd997c3925bee8212b2732b2a78afa8c285905e37667bfa877d5102aedf36060b0abebc61fdc4b5f7296d3ac808b51f173547ae02982d27a198c24b933c8e4d671f6a7c5b8c00a548fb1dcd8526528f615b69773b706b2a26592ab3ddc2bed284a8d5c4675bef4c3a96e93d5cf0c6eca1f2712109b3ca2e95ec71fa657c4f3ad8c5ebebb2deecea47b35ad16d28aa5b317730910139f6dbfea918cdfcff9f80d63a0974f2b1cb987f1ddb2ef8da0dc996b53f8ff12f23cc1c51514235f02731cc70e7c2744ed39889cb87c1e303eeba1b4a37dd0fbad85b61cc7dd7c87d0b97237888bc6bad5640718ea0819c895c2deabb6e0440c9bb76ae7093d2ef76a2d7732ce524dc8e927bfb71a509951ce9842c9c79b797e89f2369c326d8d9f63623fe760e2364ffc9c3f12635f5bc31ef22e0048bcaba09174afee139888e6969382ceb2dd8db523da870c2b1ffec90a1a434b7175820c5be4c5ea7bdb75d45f2cef4a3ec6e37ecb7c0cfd13119ee462b83850cfdb88f6312bbf99af85ef4096032639e4f4135b40c5102e02a4d19aec1cd8304a8634f2f353e4ef0aceef39522ef459a299264f4b81b4b6a075654f3a13683a92fe0814f3c8bf3fffcae47190450582e7194c3e23c282667af080429429a44d6817932567019533264ec59056afce151b9ff9f4c794d2d9394e62d8b6330cac32b074b24a00465ecfec8cfec7cd23895de7d012239d267be1d9436ebd55decf4431a62871626d238044d666ec546e4884a558e861249996e5f077727d700bdcb127441702f3142459beb0a8ac21d6c32706b2051b5bac600a97311160be83aa98d956f82e57220a8195335ed8d9e7dcb7aa9b30e48d1ffd2d2e8300cedb454840223d5b3e63f3e21d4e0f8244d368e44c95fb5531909e567d5c167a9287867aa4c51d962dbaeeac42cbe8aa7fc28eded8104f04fd57e3a6bbe31154525844baf126402d01fde74761de41912c626df596d963b709c7721dc3c599f0d06a642c9507a478e10d1159861158553641b5f2fc134581e40b7cdad04d11404609b7312e2ba39952877f6466091e6cc0c3a6bd3371db817bd2022411af6a2dcb613887724cfac25ee5623b80152845d1ca2ced4b6b868351f9ff15afae8505429e1901b66590f66e173161745278482befa7945887d2197b0a1c0e2c7387467b7add9da37b035dbc7642a59d399e9b3ee7e1420ce692302fee1e3c6b2af701e72ba3af68312925232b19426aaacde6630eb2b63a867239e76d76574179011e7472e3b190f8368cd9e17eb1ef0642ad0e25463948228a4160a4c709bc4194f2b4c30e00445a1c9ae9c3326f8231b7708141928371d4950ba90efb0a68f0b2b44964c33dc11fdfa4e2c96121a3b316200406945910a852e54e012b23fe67ac34621e71f089310638e5d8ea87a9cf76737f3a6369ca447aff1b174e1fd9cb58487038fe49ab4b96cf4a2b01f1eef6210a72d0e42f90be8b2e94d15bed3c0057cc7f761784f4ee90ed94f72d2554654eeba500b324a1b05a688b30f06aafe72b3e8b388bea44cd4a2c29c158ebeaa9624f139ef42b75738d26fae2e2247ee0985be11db72583a30f13a28d019e814191e35655642854c1298a49ccb1ff42d21d3b667edb73ed7e9d753d0b81d015f211ad304b360ab852fd41e8764189591017b36b91dfef02af2aa89882bf58aeffa06dcc9c9fc5aaef9b0127f9b06f9e1542765bd699e2a5bf3fc37f9cf108586872f787b2490fd3cc750135711fee7dba2db8b78a71392e3e4e70a02cad7defe7022c06f0ed4a10c8360380c97fa66acb23d8cbc3e554900a717ced025eafee2b5c74baee2e85230f02a086cc38d5c788e70164e70d892735376c2bb62ae1fe84559e0e257913a84a6074e901d20d6275b584f56c41d1504549bce00aa55673ce43fbf231f5cf6c105eb5fe2be56a8b54c73da04c1666787045ec1c5d2e6239a7367a161dfaf2910a36610d91a2a14d0646e4717f672a9de5b797917b3e2651cb1a492b0e0333fbcf98087f4909ae439d389d181dd8e975cbb0b9c82b2bdeb2e7bb569b5ce3dcc5a4df4a86a6cf2a83a6018799604c0806c404ce2c314c2b0a5bfbb5751e8cc46927e91730f5f432715976e77a7b63e9f80a594ef2b4330ee4c0673bedfdc3c96bb87faf25773669bf74d9b6ef14f131a42d631fc6c32901e8123ba52a6e47673925161a8bd80cc790a0df95e97e2bef94f2a3e569f7eddc88eda8eb0809301e317a2a756d56da2949aac8c7ac7025f244be73465dd3997bdce8e934cf58d60c25db3454c42e1a8f21cc06c424e08b910af2ef98d1002dd460bc6f4a1e946ba724f39eeabd783a5a729173a5f03da2ffd131e7db583ac707169bf1fbf5249408daf84e32c891e5de0d7cf9a581b6f8480135ebc1c9d824f447b5dc4c2c1c395e6d02f2abacba5faacf5b33ac644282678fd4b871c79845406c158967ecfd9890c9205e5e9ade308efd2797522450827a42f6ad1612b2c61a349306b722b0862c3cf55c41c5343d8c2efc73d2cdbddcc66886611831e4cfe5695fe296538eeaac113f2e8b198722b7173a98977bb450fd1668f885b78ce0652003a86758227dffbc1a03e96689d66b96a696507579426e5c7ffacaa20ad4ca005bc6dfb889ca36ca7ab2041fdd79f436f0b1b4f8a4bd66169748215722de08aa7e40c1a24375aea00d93765519d5f55d47bdd4211c1d82dc5c6fca90e85a38eec82f71db69414b3a41a6d0dd2a48397cdc10e7683705f45e24a53e4d6df8599c4168ebe7777654685ffbe9fdbf42b0591ef38c983282b1ceb2ef1f08cb2c9951f5c559ba6f352361c635b6137a499246a2fa0ad74418368680b7ffd9c904825a1760b26027848e39eb0f2c6f2c6119a77d202ec50b9a0be7edbf246ce112f073ea530f2fa19aa27b47c0e7bef10f538b6ae77c06af86e17025fd5acc55a22d1312e00da60888ba250f80297bbbcf61bea6eb12e2bc1c75fa0558f69d9998bb2bfdd2745e3942ae16dc2f2031d864943eda12b5e4b9cb6e642d9a88c738df621672a5ec23401bf69b3cb1d40963ea6eb98a142a3fce330aa153e30d6e42e65ed2f632b5dd613a5f0d06c1dd116b11a3e3b79fcbf1f16b8609bd97f4a476a615125600e0403e432bcf9279696c57ed1a25a3058ddc6308814747f8ccea1b83a36cb8690210f3d9a7a55d9dac8743159f2ac5abb5875d6f165559919df0da71602e38aeef3f7b5cf32ec4c38081bf97120f43bcf269587f85c425acd9049410b8df83b95c3b0e59f70eea895bdecc8bd24ba786b741a2192a8723b9988004416b6914c2c479af305011ce8498390cd4af54aa65146e3872cbb0c225a2ec41c5f404b55e1dc368e8497b56471e2adb25c7b7afc0a0323b0fab3477e4610501bddde421706634cf65ecad82b8a41ff9ffe69caf0a1190743d225f93c27960e9d91a7251f16c5cbdcdef24a53d599734ae7d056956a82f1fcf86df07c163e7e62521ffba875855cc382600cbb1a7c21e7add15d41b0994fda459b317c3d09c3a6097987664b7d14211b88edace5dd6c000d0fb2a8c9a2e2e86b5f415182e94e18c04674a47772ed8a8a957fc2a7ec83913ee3c3f200726356fab17c40300fe7a193353783fa479efbce7e5c00f9a98475479c7d300518ebdb018a9fdf99216fb55ddc80101412686c57ae", 0x1000, 0x6}, {&(0x7f0000002240)="6881e631faa0891d5b6d0d9be5e513d8f3eb6b55cd54be2c6bca6cfee84cf4d6b6d6134e423195d64d0272a7ab3ff3dcb99a21aaee041dcdd7ae3056fa36214554938dbad7705bbb0e612aaed74f9c22702f97cbcb02a192e5221efcd4e25205b87b16d64d4286933c7f47d9bdae32fffda6ad7eda4d161bdd662fe28034c5c7a63fc02606c02113a9c53ab4488e0a170815fbbb03e49a0e44", 0x99, 0x86e}], 0x40000, &(0x7f0000002380)={[{@meta='meta', 0x2c}, {@suiddir='suiddir', 0x2c}, {@localcaching='localcaching', 0x2c}, {@lockproto_nolock='lockproto=lock_nolock', 0x2c}, {@nodiscard='nodiscard', 0x2c}, {@upgrade='upgrade', 0x2c}]}) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) 03:01:13 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0x200000000000000}], 0x1, 0x0) 03:01:13 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)="397005", 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:13 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) 03:01:13 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) 03:01:13 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x0, 0x2000000, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) [ 172.675517] binder: 16486:16554 got reply transaction with no transaction stack [ 172.683076] binder: 16486:16554 transaction failed 29201/-71, size 0-0 line 2759 [ 172.683081] binder: undelivered TRANSACTION_ERROR: 29189 [ 172.697633] binder: undelivered TRANSACTION_ERROR: 29201 [ 172.703230] binder: undelivered TRANSACTION_ERROR: 29201 [ 172.708736] binder: send failed reply for transaction 467, target dead 03:01:13 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0x900000000000000}], 0x1, 0x0) 03:01:13 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000080)=0x6) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) [ 172.770251] binder: release 16582:16583 transaction 474 out, still active [ 172.777286] binder: unexpected work type, 4, not freed [ 172.782594] binder: undelivered TRANSACTION_COMPLETE [ 172.788754] binder: 16582:16583 BC_DEAD_BINDER_DONE 0000000000000001 not found 03:01:13 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000}) 03:01:13 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @dev, @dev}, &(0x7f0000000040)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', r1}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r2}, 0x14) r3 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0xffff, 0x1) ioctl$TIOCCBRK(r3, 0x5428) connect$netlink(r3, &(0x7f0000000240)=@proc={0x10, 0x0, 0x25dfdbfe, 0x2000}, 0xc) ioctl$KVM_GET_EMULATED_CPUID(r3, 0xc008ae09, &(0x7f0000000100)=""/168) setsockopt$bt_BT_RCVMTU(r3, 0x112, 0xd, &(0x7f00000000c0)=0x9, 0x2) [ 172.835242] binder_alloc: binder_alloc_mmap_handler: 16582 20001000-20004000 already mapped failed -16 03:01:14 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)="39708c", 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:14 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000]}) 03:01:14 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0xffffff7f00000000}], 0x1, 0x0) [ 172.920088] binder: BINDER_SET_CONTEXT_MGR already set 03:01:14 executing program 1: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @empty, 0x2}, 0x1c) r1 = accept(r0, 0x0, &(0x7f0000000340)) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f00000003c0)=0x4, 0x4) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f00000000c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="f709000000000000a70000"], &(0x7f0000000100)=0x1f) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000140)={r3, 0x7, 0x0, 0xe2a3, 0x5, 0xff}, &(0x7f0000000180)=0x14) listen(r0, 0x5eb857) r4 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r4, &(0x7f0000772000)={0x2, 0x4e23}, 0x10) r5 = accept4(r0, &(0x7f0000975000)=@can, &(0x7f0000000040)=0x80, 0x0) recvmsg$kcm(r5, &(0x7f0000002700)={&(0x7f00000001c0)=@sco, 0x80, &(0x7f0000001500), 0x0, &(0x7f0000001580)=""/185, 0xb9}, 0x0) r6 = syz_open_dev$audion(&(0x7f0000000440)='/dev/audio#\x00', 0xffffffffffffffc1, 0x40) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r6, 0x4010ae68, &(0x7f0000000480)={0x3000, 0x116000}) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000240), 0x4) socketpair$inet(0x2, 0x800, 0x4, &(0x7f0000000300)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0x14, &(0x7f0000000380)=@assoc_value, &(0x7f0000000400)=0x8) write(r4, &(0x7f0000000840), 0xff98) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r8, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) ioctl$sock_SIOCGPGRP(r8, 0x8904, &(0x7f0000000000)=0x0) ptrace$peekuser(0x3, r10, 0x3) setsockopt$inet6_mreq(r8, 0x29, 0x1b, &(0x7f0000000200)={@empty, r9}, 0x14) setsockopt$inet6_IPV6_ADDRFORM(r5, 0x29, 0x1, &(0x7f0000000080)=0x2, 0x4) [ 172.947972] binder: 16582:16583 ioctl 40046207 0 returned -16 [ 172.981989] binder_alloc: 16582: binder_alloc_buf, no vma [ 172.987650] binder: 16582:16598 transaction failed 29189/-3, size 24-8 line 2967 03:01:14 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:14 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f0000000080)={0x3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) removexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@known='security.selinux\x00') ioctl$TUNGETFEATURES(r4, 0x800454cf, &(0x7f0000000140)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:14 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0x7000000}], 0x1, 0x0) 03:01:14 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff}) 03:01:14 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x0, 0xe803, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:14 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) 03:01:14 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 173.052812] binder: 16582:16625 BC_DEAD_BINDER_DONE 0000000000000001 not found [ 173.066592] binder: undelivered TRANSACTION_ERROR: 29189 [ 173.078514] binder: send failed reply for transaction 474, target dead 03:01:14 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd}) 03:01:14 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0xffffff7f}], 0x1, 0x0) [ 173.150935] binder: release 16652:16655 transaction 479 out, still active [ 173.157961] binder: unexpected work type, 4, not freed [ 173.163265] binder: undelivered TRANSACTION_COMPLETE [ 173.169198] binder: 16652 invalid dec weak, ref 481 desc 1 s 1 w 0 03:01:14 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:14 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0x4}], 0x1, 0x0) 03:01:14 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) 03:01:14 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3}) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x500, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r4, 0x6, 0x1, &(0x7f0000000080)={0x2, 0x2, 0x1, 0xffffffffffffffff, 0x6, 0x100000001, 0x3}, 0xc) [ 173.203869] binder_alloc: binder_alloc_mmap_handler: 16652 20001000-20004000 already mapped failed -16 03:01:14 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000}) [ 173.274202] binder: BINDER_SET_CONTEXT_MGR already set 03:01:14 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 173.308933] binder: 16652:16655 ioctl 40046207 0 returned -16 [ 173.355000] binder_alloc: 16652: binder_alloc_buf, no vma [ 173.355019] binder: 16652:16692 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 173.368393] binder: 16652:16663 transaction failed 29189/-3, size 24-8 line 2967 [ 173.410274] binder: undelivered TRANSACTION_ERROR: 29189 [ 173.428772] binder: send failed reply for transaction 479, target dead [ 173.866110] dccp_xmit_packet: Payload too large (65432) for featneg. 03:01:15 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff}) 03:01:15 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0xffffff97}], 0x1, 0x0) 03:01:15 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x0, 0x2, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:15 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000001c0)={r2, 0x10001, 0x4, r3}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000080)=0xc) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, r5) 03:01:15 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}) 03:01:15 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x400c630e, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:15 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) modify_ldt$read(0x0, &(0x7f0000000000)=""/71, 0x47) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) 03:01:15 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:15 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) 03:01:15 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0x400000000000000}], 0x1, 0x0) [ 174.074782] binder: release 16711:16712 transaction 484 out, still active [ 174.081791] binder: unexpected work type, 4, not freed [ 174.087091] binder: undelivered TRANSACTION_COMPLETE [ 174.096794] binder_alloc: binder_alloc_mmap_handler: 16711 20001000-20004000 already mapped failed -16 03:01:15 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x100) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:15 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]}) [ 174.147191] binder: BINDER_SET_CONTEXT_MGR already set 03:01:15 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:15 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd}) [ 174.175917] binder: 16711:16712 ioctl 40046207 0 returned -16 [ 174.216040] binder_alloc: 16711: binder_alloc_buf, no vma 03:01:15 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x0, 0xe803000000000000, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) [ 174.221676] binder: 16711:16732 transaction failed 29189/-3, size 24-8 line 2967 03:01:15 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000000)={'veth1\x00', {0x2, 0x4e21, @multicast2=0xe0000002}}) r1 = syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x3, 0x4000) openat$cgroup_type(r1, &(0x7f0000000200)='cgroup.type\x00', 0x2, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000340)={&(0x7f0000000240)={0x10}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)=@ipv4_getaddr={0x78, 0x16, 0x201, 0x70bd2a, 0x25dfdbff, {0x2, 0x3f, 0x80, 0xff, r3}, [@IFA_BROADCAST={0x8, 0x4, @rand_addr=0x3}, @IFA_CACHEINFO={0x14, 0x6, {0x2, 0x8000, 0x8}}, @IFA_LABEL={0x14, 0x3, 'ipddp0\x00'}, @IFA_LABEL={0x14, 0x3, 'veth0_to_bridge\x00'}, @IFA_CACHEINFO={0x14, 0x6, {0x8, 0x10001, 0x80, 0x7}}, @IFA_BROADCAST={0x8, 0x4, @remote={0xac, 0x14, 0x14, 0xbb}}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) bind$packet(r4, &(0x7f0000000100)={0x11, 0x83de7798790eea47, r3, 0x1, 0xdde, 0x6, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x1f}}, 0x14) setsockopt$bt_BT_CHANNEL_POLICY(r4, 0x112, 0xa, &(0x7f0000000080)=0x27, 0x4) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000140)={@empty, r3}, 0x14) setsockopt$IP_VS_SO_SET_EDIT(r4, 0x0, 0x483, &(0x7f00000000c0)={0x0, @multicast1=0xe0000001, 0x4e23, 0x4, 'fo\x00', 0x34, 0xffffffff00000000, 0x37}, 0x2c) 03:01:15 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x998a4555b3ebb9e3, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000015c0)={r3}) r4 = eventfd(0x0) accept4$packet(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000100)=0x14, 0x80000) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x3ff, r4}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000040)={r4}) alarm(0x10000) timerfd_gettime(r1, &(0x7f0000000140)) 03:01:15 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0x100000000000000}], 0x1, 0x0) 03:01:15 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:15 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000}) [ 174.306736] binder: 16711:16755 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 03:01:15 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) 03:01:15 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1500}], 0x0, 0x0, &(0x7f0000000500)}) 03:01:15 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/qat_adf_ctl\x00', 0x400, 0x0) setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, &(0x7f00000004c0)={'nat\x00', 0x0, 0x0, 0x0, [], 0x2, &(0x7f0000000300)=[{}, {}], 0x0, [{}, {}]}, 0x98) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) ioctl(r0, 0x2, &(0x7f0000000340)="2cd34b451544e3bc41a6cb2e1b381358749810aada479f1392b1426a4bede9ea33977a59b5862e74b0de05871b6216d39e8fad475803affec3537c20045ce746bd0d18b9c6218cd4eda33e5e1fd4d5300efdcf85ecd0c6b3") ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', r1}) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000280)=[{&(0x7f00000000c0)="b300718860ca2777f75e3e15e6fb7e24351facf1c24613d267c1c7afcf7e209bb72913b19fb79493707aebe6ceb20283d3a14204f779e7cdadb16cca60bf5f9c7af0394f9fb5fcfbf97d7c77b0b6d3ce3fc38def6bdb1794b756b4a3b0a2ac9e6529da67bc1a09c5b97891ac101e746c44c5fbd19a9b93b8f46ec8748f6fd2fec31402eeaa927265f7d2aa846a621a41a766c3be4850ddd8930628bcb343b2c261d5593e8874ffcfd37367eec91262c9c9125facc2353263656e0a05f5a0f0492f2f5d1695b759d5a66f424a056bb43e825b", 0xd2, 0xffffffffffff0000}, {&(0x7f0000000240)="716f813b488bee633031eb31315cf2c6a20faad0c4e575fe49e01bd847b4200b39452db248", 0x25, 0x8}], 0x400, &(0x7f00000003c0)=ANY=[@ANYBLOB="63617365182f465df79ca6a61245a35f7365077369746976653d6e6f3d7b7f3f382c987466382c64697361626c655f7370617273653d7965733d34352c757466382c0037a2cf14cee832e2e860feacb6c34512ce3cf9705066874dc467c4e060e5ec63390321ffd819b3e888c318f5a07a9c31baa40640000000000000098de676c1a4e39ce06f47d389f2534a3cb800000000fc3be8524d7168d8b387ff1351ab5b8a5169fa6475b39f3acaacdbbcfa130d669ea522890d70a93a43c3f8bc570abec39d9c7061e2a2e4890b71e541880a90bdead6ea5833bd3a54de39eb6ca735b61cf4a975b36e0033954f34d252e4"]) syz_open_dev$dspn(&(0x7f0000000580)='/dev/dsp#\x00', 0x2, 0x0) 03:01:15 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0x700}], 0x1, 0x0) [ 174.355557] binder: undelivered TRANSACTION_ERROR: 29189 [ 174.371077] binder: send failed reply for transaction 484, target dead [ 174.383743] irq bypass consumer (token 00000000c0ecb25d) registration fails: -16 03:01:15 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff}) 03:01:15 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x0, 0xff03000000000000, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:15 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)="3970fd", 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 174.476228] binder: release 16793:16796 transaction 489 out, still active [ 174.483243] binder: unexpected work type, 4, not freed [ 174.488550] binder: undelivered TRANSACTION_COMPLETE [ 174.498256] ntfs: (device loop1): parse_options(): Unrecognized mount option case/F]÷œ¦¦E£_sesitive. [ 174.507855] ntfs: (device loop1): parse_options(): Unrecognized mount option ˜tf8. [ 174.515597] ntfs: (device loop1): parse_options(): The disable_sparse option requires a boolean argument. 03:01:15 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000080)={0x3, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x7, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r4}) ioctl$sock_SIOCGIFCONF(r3, 0x8910, &(0x7f0000000140)=@req={0x28, &(0x7f0000000100)={'ifb0\x00', @ifru_settings={0x101, 0x5, @cisco=&(0x7f00000000c0)={0x4, 0x1}}}}) 03:01:15 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0xe}], 0x1, 0x0) [ 174.520344] binder: 16793:16796 IncRefs 0 refcount change on invalid ref 5376 ret -22 03:01:15 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000]}) [ 174.586252] ntfs: (device loop1): parse_options(): Unrecognized mount option case/F]÷œ¦¦E£_sesitive. [ 174.595874] ntfs: (device loop1): parse_options(): Unrecognized mount option ˜tf8. [ 174.603624] ntfs: (device loop1): parse_options(): The disable_sparse option requires a boolean argument. [ 174.619592] irq bypass consumer (token 0000000081bd1ee4) registration fails: -16 03:01:15 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000}) 03:01:15 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0xa00}], 0x1, 0x0) 03:01:15 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)="3970fe", 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 174.660472] binder_alloc: binder_alloc_mmap_handler: 16793 20001000-20004000 already mapped failed -16 03:01:15 executing program 5: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x1, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={r0, 0x28, &(0x7f0000000100)}, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x20000, 0x0) ioctl$KVM_DEASSIGN_PCI_DEVICE(r2, 0x4040ae72, &(0x7f0000000080)={0x0, 0x100000000, 0x1, 0x0, 0x2ac}) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f00000015c0)={r4}) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000180)={r5}) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000040)={r5}) 03:01:15 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff}) 03:01:15 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) 03:01:15 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r2, 0x0, 0x485, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f0000000040)={0x0, 0x11, "0b195bb7f4139d5d049f231ac907147b74"}, &(0x7f0000000080)=0x19) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r2, 0x84, 0x23, &(0x7f00000000c0)={r3, 0xfa13}, 0x8) [ 174.745227] binder: BINDER_SET_CONTEXT_MGR already set [ 174.779760] binder: 16793:16796 ioctl 40046207 0 returned -16 [ 174.822525] binder: 16793:16864 IncRefs 0 refcount change on invalid ref 5376 ret -22 [ 174.822530] binder_alloc: 16793: binder_alloc_buf, no vma [ 174.822556] binder: 16793:16831 transaction failed 29189/-3, size 24-8 line 2967 [ 174.883357] binder: send failed reply for transaction 489, target dead [ 174.891783] binder: undelivered TRANSACTION_ERROR: 29189 03:01:16 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0xfdfdffff00000000, 0x0, &(0x7f0000000500)}) 03:01:16 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x0, 0x1000000, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:16 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0xa00000000000000}], 0x1, 0x0) 03:01:16 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)="3970d8", 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:16 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd}) 03:01:16 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) sync_file_range(r0, 0x6, 0x100000001, 0x2) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000040)={0x0, 0x3}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f00000000c0)={0x8b, 0x10001, 0x0, 0x0, 0x0, 0xfff, 0x501, 0x1, r3}, &(0x7f0000000100)=0x20) 03:01:16 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}) 03:01:16 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) r3 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x2a0, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r3, 0x5385, &(0x7f0000000080)={0xb9, ""/185}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) setsockopt$inet_group_source_req(r3, 0x0, 0x0, &(0x7f00000001c0)={0x7f, {{0x2, 0x4e20, @remote={0xac, 0x14, 0x14, 0xbb}}}, {{0x2, 0x4e21, @broadcast=0xffffffff}}}, 0x108) ioctl$KVM_ASSIGN_DEV_IRQ(r3, 0x4040ae70, &(0x7f0000000480)={0x81, 0x3, 0x0, 0x701}) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r4}) getresuid(&(0x7f0000000300), &(0x7f0000000340)=0x0, &(0x7f00000003c0)) accept$alg(r3, 0x0, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000440)={&(0x7f0000000140)={0x10}, 0xc, &(0x7f0000000400)={&(0x7f0000001600)={0x1278, 0x35, 0x404, 0x70bd2b, 0x25dfdbfd, {0x3}, [@nested={0x10, 0x29, [@typed={0xc, 0x7b, @u64=0x80000000}]}, @nested={0x110, 0x1b, [@typed={0x4, 0x22}, @typed={0x10, 0x82, @str='/dev/kvm\x00'}, @generic="89c5134cba77c974d8e1cf47c4e97923d6373f709e25c4e35b157eae41e0b51bbde8b5053bbf629ed7d44d725efdc71ae24c5aa655120b7c19a547558cd9ac26a1577703d51f95b68e25554f50db10ae6db1704e2ab32fa7b3b85016fa5f281e8d3a32fd369544bcee3d5d207ba6fd01818b0d96a940fc989a7f870a98c84ad328c6069ee8ba0b4805f6381b6a07a02666f769435b8ef40636591a14856a194b378bf7fd2faeea4a83feba3c65ffbc68c57e617cedf82189f629ec8541baa3a82639ac8cea42412d83f96351b0003892db50a806a64522c79f4f1b170e8239b25ff78d", @typed={0x14, 0x6f, @ipv6=@local={0xfe, 0x80, [], 0xaa}}]}, @generic="c9507dfd5f25cc0af2a5ca9b3176da8b92a5393e614fb1486190955ebc7d3b133249da76642a1dea6b82d842a28c2b95bb1fb356fee20bbb5859c83e700d870ad3970dcc2bf484414e4f735e8c88066552", @typed={0x8, 0x4e, @uid=r5}, @generic="f4399ab4d5cdeb7c89044e606e0a543b47bd6b4a845777c58a50acf4434a1dee2b77130c7a221fd26501a0980d585f6b81f84ff9d859aadfaf90a9dbe7729be49680149f13d05ab13bd050f6ec64be4bcf44527da8075562fd3f5d916bd4068b9ffd5c0cb4b56a7ca996434c533057fe7590c18987acd75ee0cb422a2ae0e9abea208af5b91dc4658608a5568aea39ee313891e43f7a0097b025572f73fbc8f0dbec8107a6b0fca054549183a14a8adcc067a411d960fd037be2e21d2477810e03226c4aa4eadeb97b9831e6263b32d50899db6928d21f0bd024d846242c9f64cf131e1339704c95f954271544fb05cd2dda3eb36d5821d211f5e4d016f8bb9929015f46fd95b8508e48116958dfa6319dbead7396a415af6502282497ad7bf2610ca1c6600305b8a5406b6addf94f58ae8e16eae0c7957ed02d1b83e567ffb47d8c74689f20ae37b95cb74a335f7671032c36a3c4681fab8d4b7ebea85cb2e8feffeb0536f91e50c1255eeacc9dd23d20e4b94b4911d5e522a798c4d861c6003f72285c080eb770262a9e6bf0317ed166f56890ebf2382f6c262e0c4df42e957c253ec73d5a8e8502ca718eba6af8f89ec637050561ec629f10bd570103c778d4e2f09a3bc5e63fbe1e8a0856d1046c504450f044083c8eb9b32b0d36cf41d91b2b617ab844e92d8d0ad7383db20bde16239a23628dea8d2fb4a6f166c1f864f3fae5305937f45248ec81777650371de9da49c1d692f474cdca5c43b333550b5bbaa918f56ee7b73c9098e4444a037ad56cc8fa20294176c52d4a3f02eac57a4c32cf653a54262106d7926d540da527c10a8c5303dc5a7e649af083a5aa856baa9ee10c71afe5a9b0dbabecc9fc98faa6694a6f5dadbfa9a06e1aa134e98cfeb534f1346e69e43be6c340a51d37cc47f88e6b01b5b3ee6701cf0585de8c1615527b957c6146a373ffbd1c1b710c3ffed9cfa2e7cf93bc8cc55f5bdd63c1f698f5fbd2ebba70de96f9e25d118759023c08966c78471224c60a0048b5e8407def8cdb390a0d086dc3975f0ab6f870bd7212ac10a0f5b9dc9a53e5394b3306a2e7cb982b41d35f2d3ee2c138483bf19db9cb970cbe91573b6f342b0aa6eff85e3a405525eeacb54b6f0dffb0827ee6095ea53623d2eb147ab7dc15d7bd10e3afd28ef47f016a6cbf3acbed438e3a07b8f3558be63cbd5b263717eba7a96610a6cf28215089e9bc2ce9c7750449624cdb2229571177b1865f4aacd900439a45eef906472fab72626665e90cd9f89b84413b8ccc1ed2fc03e7b5690247250d1ceb4ad46cf70a2264eba8c3b81a39e454fd1941891e59e581f231bf7e7cc47824f43dfdc5d5d8e1eee47eb2234a277b36ff177caf461bfd9056013d92a635724e5942ae31f27586fe824af0a86b39e66711e4e4f46b25fd4637d9e9c56c58aa26053a9851744efb833ede64c473f3b62bfe41ad029d31a2c0c1cc4f9f183a4b0369729bbc3247847796f98ebf336177f364af7e914569f6e9430523390ce752c0bf248a06b1dc16d54207c2b44d146f1bc2c5f62818e28e54faefef71dea950326cabee3abb3f74b1ad6f2498631ef99d2d90a972e3271bdd31fab323b8b77cb85737ddd27006e5983e9cdb44bd448d9ec0c466ce414fd4b4d92b92334bdbe260ff8e6e5b3158262325ee8cfc709b32b243ac5560c0fae77de25042b43bbfe469bfa7b822958f09ca2aa30c6a6b46c0101e9aa647353285a19785edcdc57f110734b44b6de3b585e2cc3dc47d37c46c3f9652d01a32a8297466831af62e4ac6fc7c635f7a71cc6ca1ba379706e1dd64e925df093a3943e2b810043ec0a1d6b5acc4f43d7fee58a18056bbafacb0a0934e40710907347a5aa83da0fad7741ca1f5e2f08ab89b537263acda642def05580f33d2d09ba7a695f27095ecfbff811a12028d5e226aec41bb93dcb028b91a9beeeb3843faf94c96af21e29a2e3f521658d76ee5cf618fdc674c3efa64a6379d8517fc6e01a45b1b5f501ab2b201cd283c714fb9e6d0acbc93efa419d5c285e39b5454195497eeb44d5a3dda34a5d6abd9816ccea5e9a9b61466a9c546fd9e0bc08ce9ffc99946166915d77c0dae058caf0a25e1d6f3a794eb068091c6c560035343c0806a3fe0b96c97353f0ca244e058896abfc824550c141d293c342f139ec316bdec7ed3564d5fd279b513ca5901582723a4de131b31c736c32889e71c0cb4c440a3849bebe8f882944d55e123efed90efa2fc7dbb78ddf32e4966105b83b2d9c7e5f6de999aa93d96a0d086992c5e49cb2345e9a22ad4d1d45960efb6ac1954b090fb530dac0387e27cc962051e046087f475417dc42ca8afa1ce8fb7457a0755ff2a3957791f6c7077074bf8f75daaa10320ddbb315d6712cfffc771e9ea026777d1c85e00b782df15f87e12b84f46428fd5940ba061bc7fd63d529f74d9692bdfb1cc0586e70f19cc7efe7a5763f769bc6fd07fdf5405f01b3a513ba34c7471f42326c75c6e1798b4dda2a8c103e2b11bb2c36603de5b2331b0a8d5f72405deca7fc20cd2ee645fde78f4137d5e6bcee0820edc217802dee4215a8b691ff2ce6bda1098bcc94c2390ed09f92440690fae873920cdb5354612851a4e6285406109d5a4a630de610d2477b0d6580016394157c24a3a54e1d49c81aeea83513d53065c88cc5a3bd81094fb36a463710d912f7e53f58d03be368f2d6af6535e76698f29ef9b2501cda28616ea30ac276b910e9b7eabbb25fad09e670ca4072a2f7a3caac772ada1f2540dce80e284ec78608ae2bd091993933307cf131a00a488893c88222bbbc14356ad158f69f74c484efb4141a96cd326097e72b69b006e60666b61cbebdf2f6fb7a31d077a78159b2d57c4cfe35b4c12316d776385431557fc06b2a177b35e1c3657d78753ae7991d384b428792139982aa6db17ffd409486a987ac92545364f7eec9227e63b7445d4a55e82a584c24adeea564d0c4c6701ea79ed67f28d64eb7553b5cafaa6ecefff292e2ab0bb4d089d42548a4e9a6fbe03b814ad10a90cce96e867daaf43ab74e2321977ba9391fe00997c18435927b1b115cb693cee0f980c8c715059e3e34d19660ce46879192f160996726ee385ee5187ec341855f8bb9ba12401380251f652bf264cf1467f754cb5fd852dfbd89c085cdeef690da17610fc6ad4311e612b7dff7e05e6586370e5243cccd5e4fea148793498bac8d8439e10c96baef8aa106386481cfc4947413fb76b8ff1657b7c13fe1f22d09ade2b2829ec8a1bd58a58e6d19abe42d86fddf273aa76fb2d17a4708451b9ae60305365a9a4566e62cb7304da68f9a87a4b276bb93dceca32b0e539f8cb26de139b5bffbc8cfe0f102e181c9c3d546bd1e9881d25fb8ac11eaccaba7eeb3afd9f1fade715366807ad063e9e85c6f1cf89abebb3b842f244cf3579e0bc42b13484dfb48eeea3753c84c2365f384fec37f22356aa91a7bfb2de234456ee0ab21447da26548db96dca6ff9bf30a84a366e6c36cd581c4f0e858a40a5fcaf48f2a72d1f8f0a48eba2e89e096acc86afd47d6dcbd8053d6760288f95cbbaa6ef1a2be82506f7fb0f6d79fd4f90b0e3f7df54e0c3a9e1061c6d73d828254c0d4dbbca9e3c9c4f0d384e13dedddc07f5bc293c642e1133f73d078abf5d13946ff4c679031cc68a0703136e4776669fb1c5fa25828739d1d85f4056dcc232de65a554d9d7e903cb88c1b847dfcedd3cfdc8af812a26cdc9761f124224672a1ecf3eb407c9ed1fdff5ad4f383aaf7f4f6ea7655b36384a53c22c353c11f571d6194eeb3706d82ad746df282eb9140a1e3e3ee836f7cebe9fe53cafc2a485acb04da041799bdd98aa5f5ba1669fce236d8419bb6d62507768a81808083a2dfc7744565be07b3bcdb6bff7ff5130fe22d715270385382b202986602ffb0f50ba8097f0ecc28d05d765778ec0430bddae31c78b589344183c0f8e6e7d50ffeba0189c180f344c9c5e4a05075570c4cf7ae5725a3f02491488514c93664aec7ae538e5e52636ddda3e0e9dcc6e25ecebda131374da1edd7402ebc7d4d9f86de9bee0d44a80c3fec525499a430d3900ec26b82782a19d211928ba3718b21dc35ce1dc5c2098495f564ef7b6003ae7cc7c4efcb98d808c77a6e0938a6ca97d50df2004a02756c68b899df3f8189b980885f94b3e13f665822d44e31515aa5bde9e4e03ea641dfcd252cd7a2be34bc0f1bda149eda20b136324fbbea5e91dc0126988a259bf175a8d0f378d9e1020b50e78cc823e3625e48c66ef85f9b23cce87aadedf1ac75b8865edba0eccfc9cb3be46b0f3cf8327dee6e4af690c36419e6750339d3b7aa09f6d6b6ccac9fb39ed4abe1b4963d3877c6b1af47b9a148cdfb069cb2a2e65016c22d91ed03def7b055357466be8ba629302b6e07c75fef4febbb7a581022da0c244e46cfefa354dd647fd9aa2d7b49e6086a7a72b6608b6e66126393406e34c3fd9bd6836f2862c90fa9f64d798865cfc77718a4634bd8bfa45e011bef0800783a93e31e8979edaf1f3b77fd2ca9a4dd84dc55a7552396f775b3a645ff093ecce4f86f9cda4cd5d8929bcdb4bcb99e548229f1c44993d2570271cdc7087a2a9d5018204f06cf522586f92b9f649be1b4e92d763fabad44c32ab7f4fe5d0296d2bbdb73d356422e0f5e392c81d1e02fd5256238c9f4a7cbf41386bf7fe9311fdc3bb7e8e0ec5ad9ce06c8abdb8b7f6e802efe5d414e2d104731a4735609fbeb302b838d1b3729966bdddd340e15132ea3a974202a5316deb8a550ed7de5bd47cef98d91b570a354200db69e96c0c5ac1e5da81f3fa6c78854cc2e81536bbe7e9ebfce5f2ad33bb797ab5dc0bac8e45e59653620fb5c959d0180be0d849bcbebc39d7b6802713a3e377e520f32533cb9fe4f8ab29f9bc709647dbb197531d4a5d4b9d730ff5b85f726f6481f28ce192300ee7784031e557ea20e60b99386c63e2459f7196d344d425f2ec761895fe072e217ce1168e5c157272389096591e9f84a7d72fca5c13556d54b7a5ca8ef9c78ff059029a524b0e7dbf943195b3813cffd0a5249eb883963cb0fedab4e5a09f2560e7b63d33f8e26eaf4af52c1778ce51751227727325038612ece7c97396c4a34069a7bdca66af68ee67bcb25aa8acba4f275251cfa2ce20a9d10601a66283b262d34843288e4bd4a9500f0725e6adfa2f50474bbcf6a565d00bde32780942645406f1608cc1c09a29e48106391190b2076f72324ca4455e246f524bc0031e52beefb832f62508a19e2f8ba1f553d38ee3c964a9232e0a46de4575536f08bbaae4f2449f75fe6f46d4959db5f96f2ed109cb50af33b711e8e5c04be332bec8605ab729b8ca90d0ce6ad2fe340915068bd85fadc9ad2c3606652ab76360f46b78d26c32a51d9582cdc88e1c04bb21e596de7653cf3f20a898a77c707d604c6784226fc26937f5a80664ccda4b3c874a7526e3eba7a9291a3add4103eb76d6931de44d75212d47713532923bcd9a9d04f061f7a6dd21ec47a44b8030d9d15da6ff1173b4f19b4b610f5914c80495b860466ee1615708d62b2b41340ec7be1bcfafea14245b2e8efa198017413ed137bd451d8cd7a4d325287d78fc2563576bfbcb4a4a721864ba8fcfb3324730a794800eeb980b0f3c2c67087d0818f8ae5014b86965bd5f159bb45609c75bab0e56f1a7a7c9e4f2d23177e9fbb0a14a443e54c4256bdb06798c872af3c59894a0f17b0237103851cb6d7448b48bc52367", @generic="848488a7861ec37ee117c10b80aa52b716457b285e7d07f2324a81a8e64d51f37e57b784b4970ac87fb315a8e9c42fad23930695ae0c1b9af3dbe5704a44b66cf108f97903bf9b8d726ed75d0a165a3af41418d13483b5c6edd75dcac6622cf5496391f928306906387d16e35b0d5c77a436116c743288120d34c9ada535ddc12d251f954fea44da753661253f8d6d44c11187978131150d0567e1b4d595dafdaec44aa10b828e16e435af7f0c04264bf39c9b41ba32da39a0b933ee932a46e2e134db339e880011598c103ddf5b4a4309b0b07955bb018461e7f9d4b551bb45ad982a71b393cca1ce7db7"]}, 0x1278}, 0x1, 0x0, 0x0, 0x40000}, 0x10) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r4, 0x1}) 03:01:16 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0x4000000}], 0x1, 0x0) 03:01:16 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock\x00', 0x800, 0x0) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000240)='team\x00') sendmsg$TEAM_CMD_OPTIONS_GET(r2, &(0x7f00000004c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4008000}, 0xc, &(0x7f0000000480)={&(0x7f0000000280)={0x1e8, r3, 0x221, 0x70bd2b, 0x25dfdbfd, {0x2}, [{{0x8, 0x1, r1}, {0x44, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r1}}}]}}, {{0x8, 0x1, r1}, {0xe4, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x4}}}]}}, {{0x8, 0x1, r1}, {0x3c, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r1}}}]}}, {{0x8, 0x1, r1}, {0x50, 0x2, [{0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8, 0x3, 0xb}, {0x1c, 0x4, [{0x2, 0x80000000, 0x401, 0x80000000}, {0x5, 0x6, 0x100000001, 0x7}, {0xedc, 0x3, 0x80, 0x1}]}}}]}}]}, 0x1e8}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) fallocate(r2, 0x0, 0x4, 0x1) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000140)=0x4, 0x4) r4 = fcntl$dupfd(r0, 0x0, r0) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') sendmsg$TEAM_CMD_OPTIONS_GET(r4, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000080)={&(0x7f0000000840)=ANY=[@ANYBLOB="c8040000", @ANYRES16=r5, @ANYBLOB="00042abd7000fedbdf250200000008000100", @ANYRES32=r1, @ANYBLOB="7c00020040000100240001006d6f64650000000000000000000000000000000000000000000000000000000008000300050000001000040062726f61646361737400000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000800030003000000080004000200000008000100", @ANYRES32=r1, @ANYBLOB="2c02020044000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b000000140004000000090004000000ff0006e1761e000040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000100000008000600", @ANYRES32=r1, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000900000008000600", @ANYRES32=r1, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000800030003000000080004000100000038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000800030003000000080004008000000038000100240001006c625f73746174735f726566726573685f696e74657276616c00000000000000080003000300000008000400e81c000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000010000008000600", @ANYRES32=r1, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000100000008000600", @ANYRES32=r1, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="f40102003c000100240001006c625f74785f696574686f640000000000000000000000000000000000000000080003bde3bce0aaeec900050000e118bc45be3ff835680000000000000000240001007175000000000000000020000000000000000000000000000800030003000000080004000200000008000600f71ba45c7bd67ae1ff43b0cf9fa578af9309e94c54bbeb551cb40e11a11bd50f758d52c3108e69e0f9d0c1e34effe708907eff9e000078ba22c3b8b149db3c381a21aa58d67497896b509eb2f483762c9e1613293e1eb8839e158650d7f194f52a7a6daad2445dceb74d15ebeebe0ea373ac4bd19337a1add231c11a471818cc987a909c6aef5917ea368e8586f2d8427958bc9edeb0cf9566c2e7a9c127e21d98d1ba505b3ec2c790225c15b0f49a87de64405e3cc7700190609b4239f59cd497961c86f0f64b6f04360c095c2e89c63f9052764efabf5cc0b35787c3d0d26deb0d0b56dbaf5a01ab600d820ec1fe28b3d5980d90e11b7a4c046107b8a834ed7ad9e2d8dca97fbdd02cc807007f05fd14", @ANYRES32=r1, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000300000008000600", @ANYRES32=r1, @ANYBLOB="3c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r1, @ANYBLOB="6c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000003c000400eb3e06ffff07000080fff90202000000050046000000010000000901fdffffffd2fd020406000000010001020300000003000006050000004c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000001c0004000000080f030000000900000005000000020003000200000040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004006e99000008000600", @ANYRES32=r1], 0x4c8}, 0x1, 0x0, 0x0, 0x40000}, 0x20004040) 03:01:16 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000]}) 03:01:16 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd}) 03:01:16 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) r4 = accept(r0, &(0x7f00000005c0)=@rc, &(0x7f0000000640)=0x80) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffff9c, 0x84, 0x75, &(0x7f0000000680)={0x0, 0xbf}, &(0x7f00000006c0)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r4, 0x84, 0xf, &(0x7f0000000700)={r5, @in6={{0xa, 0x4e20, 0x6, @mcast1={0xff, 0x1, [], 0x1}, 0x8}}, 0x1, 0x3, 0x10000, 0x7, 0x80}, &(0x7f00000007c0)=0x98) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x8000, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r6, 0x29, 0xcd, &(0x7f0000000080)={{0xa, 0x4e23, 0x7, @mcast2={0xff, 0x2, [], 0x1}, 0x736c}, {0xa, 0x4e21, 0x100000000, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}, 0x28e}, 0x4e7, [0x688, 0x7, 0xffff, 0xfff, 0x4, 0x80000000, 0x2, 0xffffffff]}, 0x5c) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) 03:01:16 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) [ 175.044065] binder: release 16901:16904 transaction 494 out, still active [ 175.051085] binder: unexpected work type, 4, not freed [ 175.056402] binder: undelivered TRANSACTION_COMPLETE 03:01:16 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6(0xa, 0x1, 0x4) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000), 0x10) 03:01:16 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0xe00}], 0x1, 0x0) [ 175.834789] binder_alloc: binder_alloc_mmap_handler: 16901 20001000-20004000 already mapped failed -16 [ 175.847674] binder: BINDER_SET_CONTEXT_MGR already set [ 175.853029] binder_alloc: 16901: binder_alloc_buf, no vma [ 175.853126] binder: 16901:16952 ioctl 40046207 0 returned -16 [ 175.858609] binder: 16901:16953 transaction failed 29189/-3, size 24-8 line 2967 [ 175.875377] binder: 16901:16953 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 175.875416] binder: undelivered TRANSACTION_ERROR: 29189 03:01:17 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0xfdfdffff, 0x0, &(0x7f0000000500)}) 03:01:17 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000}) 03:01:17 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x0, 0xffffff7f, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:17 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x90000, 0x40) r2 = openat(r1, &(0x7f00000001c0)='./file0\x00', 0x802, 0x120) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r2, 0x111, 0x3, 0x0, 0x4) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='io.stat\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r4, 0x84, 0x16, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0xc) r5 = eventfd(0x0) r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_quiescent_template\x00', 0x2, 0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f00000015c0)={r5}) ioctl$TIOCMBIS(r6, 0x5416, &(0x7f0000000100)=0x81) r7 = eventfd(0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000180)={r7}) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000040)={r7}) 03:01:17 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:17 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) 03:01:17 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0xfd00}], 0x1, 0x0) 03:01:17 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$IP_VS_SO_GET_VERSION(r3, 0x0, 0x480, &(0x7f00000000c0), &(0x7f0000000100)=0x40) sendto$unix(r2, &(0x7f0000000240)="9bf1770f8767393bb4ca7a3361bdf73337372ebd6fcb9bd96408f6652db0188946d32d6451a8e37290929c35a5481aa6f8ba254669cbc1506ddaaf6093c97e01986508ca81f385716e801ebd394ea1ec11038c5e8f1c0aa9c3bf3a2ae90cd5b228019331049dfca6eb5a5e99f0a00fc1a45832f8b062e30758d5df1c32a3daab7ee999ee1356e40c2ef5c10bf91da37abb807383a8a6eb1df0fe264029369b7b2ace0a589ac79fe471550c6981baf2f6c873fac311e25caf6811b66bf9c805197b89d3468f6ab6be8ea79da46bb26159d299d9978bc78687d758d4a6d2ce17a6df75b92b0d19a315a38b12048c9414e45185d7cb442673e3056ca72eb3272d681b66511245af02d87c607065ef30ae2272f7b22a670f2b090d22b6883eb799a68d52e28ecbf1d95dd78dbbccfd3b40faa5c02031c659608ba77e0c75177e24c326b68a510e5c2241566aee979e8380c555f949bf6f6f5395af5fc427a65be4bd45bffdcaa7a571843647f41a818f04a9f784c2bd15d84e8eca65dde4faf44eedbbb1a6de0fa8f9491f2efd58fc8147bc3d1ccc76605a8646716890fa269456b47224e61520a89767fa4c31e500f070deffb85ffa09701fc2a25c727ab727173210f48be2167bd042356c5824b720c0fcd92622d26efdba02bd72be9daf14b491701680b7f2875ad8eb66e98a17ee9e7611ebece2c9c2f51d703e7767359cf6cac76648def492815f34a9148b713a379d0a957532170bd1634163e866e59d147fccfdc98b26608c0e31c060c67bb2a5a2965402e681ecfadd9178daf2a41a1cc4410f49036bb3c2f99c3e15adb3894d1b1103ef30f7b84fbc712b07a8f7c5361bb6cc09d027a8ab085f2a9326e59d8f1cf4737c6c95437ed68d2cac22ca9a184b7c25e81366f84bdf20679b832c159b46a7e1f810aad0f96623cf8f90217b83e02245e64d6ae6ccf5c68f25c949c78168b8ff8275322a515a2635761af1d5a299e093ea639706160a1d01f5631ac6e8bb8b43ec3c44fa83291815898bc892cb3ee6721435285309e8f77f7db7ba528e7012e499295ddea54bd711a612c0b269c9451b4387a969a767727ca8f8212793bf3ec22959c15142e970eb140e547654b227dedb059ccdc9600ade07531946f7e618a5945552ade7646605673294925885184f7f0f0025019e68a47d6786b8fe6d4919db8d2adf96c765436cc8d4e1f26981631535e0fa90cc1de290f6d8a6e8a81368f770e052b2b92a16b2d2dd7f441c6fd602485d6fa0566349f8aa5d0b94bd0c9c56ae6dc784f25d2cddb20151d8c2fd3233076ccd124fd111672d14a140d8da6c0555bdbd7b7c558bb7cc252d85c627b5c92a1aa4af87a21b4ff8aaf67e9a1da250ff3ce694e170fbe5f05769b4a46d3222fbe43d43a358156d860d104e095bb2e97590af997b518779a44c11070195f8f9b9d1f5459f9708f6a70331906981a4164cf7c92b49c3e5f75f20395aa4b3c9a440d591947756c910cb2e14732ed949b04a0357cf87d2c87cb767cdd867fc995d87dcad85d3cb4f907e2133096a70043149d2f64371dce00bb2037d83c6d492f7d020ac3ecb7079cfde030c7ffdfef7952c40b25dd23005487694ec25b4a5dcf41ed16d60e3798bdc2d848322da7071bd8434584c32cf3d3b9dc479cfd6cd55a0c2622fc0203072da913c4f6ce9c5ec622bc0bc89837bd8ba5ef24abdf7a5e43c2cfe68c6dba6e8b19c6ab4497939a4215f6d997a3cb44f3d1993c342fbbf05b6b7f787c5b4490b7e1105f3b05b866642ccccdda46672e7a68e0190f1714f4100535b5da5600a7751c36ccd7abf00176e2ce4234f6cd40e23e87ca6ca71fc6b08ae530dd4494ab948122609f5e6e79f05e93a58bbac8de055d85dfa5359a1ed7fd99d0d40c60650803709f63deb4c96c2bb6581f85ce5726251308afc4e86b48bdbb27a5db6ee84d82dda973cc188feebb9216295aeb78587235557bea6dcd9fd31fa091368b1385861bd8bd23e5a3a3247cbb9d1c7e9e1be70c0dd083a2af080beaa35f6b5d64ca5c255c3e719efa9e2caa1f9f626649d3bae722fb8ee4cda2143255188a6660ccf9204daf2d0609c541d7fb121f1f159ba8f1cafd0b8503cec7fce0ef0de85adf99a2428814e9816b4237e7c7923e127be8063ddb6ad8db96daf99de2d7578d914ba304169cbdd5497bd11d7d9fbebc24476f0f193a175ca4289d093abf1872407cddffb41e8134d6b4494e7ef44442faaa07bdaad63180a9bea277efb13c2fb6662e8ac03ae0c8a6210893788914e7ff5cc4810f8d2e4465094b0ab219065dc196682c1f47df39c0082a5dec3219be5e4f966343bf08b2d3ec14bb5daec78c750b637c88597f08d240089ca91e6312defc02e96f3cfd7b7c10ef5518d9c17795fdfa3ca47793f5c3a53b4eda6d295e1ffa840d989bbabe7790276dfc467a0337b3ebaf12cb6e6e20761f58323b8acae82637f2a8f98ad54ba268ae0949b7ccd873f133e8a41290dc020d71b40bf1cc14abd14f4fe4fa338d817533f9caa95bbb8fbcfcfc77b99f0e42e6b2362a94e32380705ed380eaf1a819525d7b280e39d5fae2a3a6acd459729af234acf6040c43e9a9021f701eeca0462cb5a9b3950c341af942c3633c95bd667c7cce46efa688967f3d91e52ef0cddbe6d2e9893089f426199c3d0f9ea537234b80017f69e88c4960c4d32f0e9fb4a549079270edbe4f70a025b1a239090177919066267cccd9faeb08b2227856f67c20dc9919736b164f8b76c813f659a722790eeae720f79ca906aa018cd2dcb38eccd11a395576e0ed9407d9a11b997a09b650c8e7cec2856d09679970990e314026b08ecd5f0040f40ef5268e9d2df9b85e05ca77e7c3a3e481c1b79b432aacb6a55cdd0160cc183a081fb0eedf8850379104a650047d16a2a2a88be1456bb34097ff4cac8b51dc53de2f7be98ab0437004646c9a4da9e2d7b5dfbf3ba0a3117f8be1329550e395e62c3126f8f17a3ee83df447d7d600f44a48d4adac4ed370a7045f5415d480e23baa85ca5fca686c9ee95462984554c1633522d6446c32cdc43c864f19e1aa555a3924d36463e543fdf3b80be6c3e858573e4afbe332d2b7a3ef715192462322f885bb3392eb1e880f0f9965adf172b7ead08af3e6685b62f23d2b17e134e28df4d515e1e0b6a2e4dddcb91333f7a3b68750e7b6d253ff858eb513ff907433dde8e991c118796b4e49dccfcee1d02dfc53ed6e2213fa194ee90d76df9bff7dc1ae2126495b8116cfe8058fca066f80b69c3790ab7bad471887a59d5b10533c30f251b573ea5f75e1c2a8da3ad767638814467718f6bed652bc2e1dbe1467162dd40bae73d1dc8ca52ee13fed3451659f77357c16112c7f0ba41c27bef1338180a137455c673b4d1657594a79e908f811528a8e16b5516281ceec648c70d21b4fb416ebcfaaaddeddcff8e98c432625840e6c4894f241143b70a39d7b90e3080351a9f1be3888e0492420adc84138dec9923627905293b8fa6ed1e9229637f5a8c1770d9a929b9f8ebe723e9a81c9b13beec9a844f0706b482de57f3a00e2471456ad0289ffdb6567172f2b3a6c6d4e3ec8e1abb4396f7fd76f1665d9425cf67d87caa582287d914bb7e7e85e00838c26c84822b31c2834959cc92fc91f8d506e4a941141c7051750ded87e8519e2e8a93a59eb361ce880b61883379789e7b86787196cf5b624b88eb0b1e89595e81b0aafa5c339c70c79435a8bce415e0069af9786f65af5997cb69ca8b287c36e4a342359b336a1d2fe9dbe56a5e7054ad54bef720667917594e2963358feca1ab4e30593c617704dcf4e69b13b7edd36cc1bb03f9331867c7ffc6964fb6541a1d7425c26579dfd0bf9875d8374c3acd22b1a742800875acb0047d3c3348167fb0958edf45d51f6d56953bb34c1588c2c2f1b7503ad0ca8d5c4693bd5f155fdf94a9e52a1a8f5ccc28309469880bd809f9046b474254eaf47e77ee7088c13dab514d15e12ce9bea83e08378e30fd982f30180fbee2a0379bf0d127245ec53b0b333d7bf225ae3a5b69aa615e2c80ef94dc0c192dc2af3bf7836ca82d8522967b7d40c44f54b80efcf63919c2791748513a9b92bd5ef1ebaddcc6148ea45d4b0deb6f5e7383261f84cb2045c3a03d2eb0faf4c85e8cdad8617c4c13688917d5e68c2f992569afd1667c85110a3f17d55d03898fea417a7e3fcf2ee3f999e6fc042c643512c55a46e057814189123eca8d32288799182bed93a1250e0980d6dcc94e37da4f23ec5d8cd5ccf34484fb553734acd6fc9b407ffd5a3395ca4c1047eb1b02d87bda89f5dbd01351cd9519248f5fc9c48445fd18ead1bb739f460d1f65f69327cec0487d258425640c02b225bc06de6586bad51277a029f05a78d8193442ef05aa4231a83d5073b07f18fed45f7d79a74c1bc4abf0b2da1d5311d346c477c89b34e9054632f5fa5e0f8b194766e356bd6fa77640e810b2b798485a208113a71f15e890b36ef73692a68a35552114d0199f889f9771f9d90dccabf1dc5c3b8d9a6712eda9616cddd446e102b5506d05a030f5c4111cef68902f939975560eae83eb1edeea46d405d6a0deafc7029e25dda47874b4ddacc14ccdb28e75af30755d23cd82491c7c7d0b7868f02a8a1e0c2ffab59d03b7dbfe3029d3709c01866405135d13455bf241cea8813ae4b4acd706d1aff3f0bcdb97aaa084e9334204848c29fe24ced8834693abec80da41169dd5a7d736f42d2a016198551931d55294bdaa5bda42690ddcdc3c70019bdc25f940407b0dbf0484e4310f9477dd680962a4c1dc7791d4214744a65fe9dd3fc8e30fdd88d3fac4aae36ae6d1c9c599b3f837ea58661f7ef14841e795e189509a226602b6202ba43f1f5bf06cc541885e8fc33f4dc2fb001c5a373a4d9b86b86854bb5c174de52cce150b5a68787d33913254f5e903c00856092b0a47dceab0f2a16be2dc098bc70ce8937bfd29bcb272fd9960ca98f97ffef284ed0be03e70a3f9d4eafda5e3c66890e594903dd7b7bab83298aa87047f3cec096f40a9ce9f8a164f478ddc53148ad53b688f7e3e1018e1eacc2bf5d4483e1d21bcdf4e77666b8b1ea455ecb870fd91501481c84a2979f0ecf99334c3c9fa1e46e693aa516581299059eadbd79d9ca3a7284db7ecb6dffe751aca70e98f18d5b1c629b9073c32cde7e9bff462629094e68bb37e4fd3d2f0b2d02605f97eea0ff06d99f686cc77197ff2bf6bdec0a8e1a3b9c0af15cb409fcda9335e5d7c18ef9e73ee4025bf0206dcde03f9b2addb39ae490e945ffe810488a4625d7fdb272d259774b0de61894ea1fc6b2aecd1ba0da17364675dfe5711b65472907883fd9f8f1eb0524ad0838c9c21006209f2590cbe30dfe83c7afd3e60e6d8a70750a33dd6c796458d44bc5be8275dbca3f4e8cd1c9d08b600dc4d0e016d257823271a617519175680dd36f5866241dfd380098bebd34b55fda8dbc8afeb279e0835ed090ab804ab536835a9eba19697ec9fc82a471a5630acd7ca873cee6c2f37c9de6a4b2862316c998ee5cf240ebb2dc527c37635b05cfc0bc1bef7e50e8ecde5a9233fd20b8dc06671a89889071a3324804ba74686cacbd86035c3dbcc02d4eb9d841e13ba5b8b3bc580df48b6f363e26049ff33ebcca92e22a6c8b85695ced4f520df0d33ecd428e290e211785c222abf9214f6603a499259c038fa628aa9dd19fbf53755edb8f721bd146c749d35b8a2598ffce3f2dba96046cbeae3fc6225", 0x1000, 0x80, &(0x7f0000000040)=@file={0x1, './file0\x00'}, 0x6e) [ 175.989248] binder: send failed reply for transaction 494, target dead 03:01:17 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) 03:01:17 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0xfd00000000000000}], 0x1, 0x0) 03:01:17 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)="3970ff", 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:17 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff}) 03:01:17 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}) [ 176.059161] irq bypass consumer (token 000000001b2cd10a) registration fails: -16 [ 176.070454] binder: release 16973:16974 transaction 499 out, still active [ 176.077428] binder: unexpected work type, 4, not freed [ 176.082723] binder: undelivered TRANSACTION_COMPLETE [ 176.088824] binder: invalid inc weak node for 500 [ 176.093740] binder: 16973:16974 IncRefs 0 refcount change on invalid ref 1 ret -22 03:01:17 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0xfffc, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x8040, 0x0) syz_kvm_setup_cpu$x86(r4, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000080)="640fc79e0000000066ba4200edc4e15dd9ae0e0000000f30650f09660f3adffc00c4e13711d18fe978e13d000000009a96000000d4008fc9209877e9", 0x3c}], 0x1, 0x10, &(0x7f00000001c0), 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) r5 = syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0x8001b, 0x800) write$P9_RLINK(r5, &(0x7f00000001c0)={0x7, 0x47, 0x1}, 0x7) ioctl$KVM_GET_ONE_REG(r5, 0x4010aeab, &(0x7f00000000c0)={0x9, 0x32}) eventfd2(0x7, 0x80001) 03:01:17 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'gretap0\x00', &(0x7f0000000000)=@ethtool_rx_ntuple={0x35, {0x3, @ether_spec={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x10}}, @tcp_ip4_spec={@multicast1=0xe0000001, @remote={0xac, 0x14, 0x14, 0xbb}, 0x4e23, 0x4e23, 0x80}, 0x8, 0x7ff, 0x4, 0x7, 0xffffffffffffffff}}}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@empty, r1}, 0x14) 03:01:17 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd}) [ 176.226402] QAT: Invalid ioctl [ 176.239287] QAT: Invalid ioctl [ 176.264192] QAT: Invalid ioctl [ 176.280792] QAT: Invalid ioctl [ 176.287764] QAT: Invalid ioctl [ 176.291143] QAT: Invalid ioctl [ 176.294488] QAT: Invalid ioctl [ 176.297785] QAT: Invalid ioctl [ 176.301101] QAT: Invalid ioctl [ 176.310071] QAT: Invalid ioctl [ 176.329089] QAT: Invalid ioctl [ 176.336783] QAT: Invalid ioctl [ 176.340082] QAT: Invalid ioctl [ 176.343296] QAT: Invalid ioctl [ 176.346494] QAT: Invalid ioctl [ 176.349687] QAT: Invalid ioctl [ 176.352891] QAT: Invalid ioctl [ 176.356084] QAT: Invalid ioctl [ 176.359288] QAT: Invalid ioctl [ 176.362474] QAT: Invalid ioctl [ 176.365664] QAT: Invalid ioctl [ 176.368870] QAT: Invalid ioctl [ 176.372064] QAT: Invalid ioctl [ 176.375260] QAT: Invalid ioctl [ 176.378451] QAT: Invalid ioctl [ 176.381643] QAT: Invalid ioctl [ 176.390702] QAT: Invalid ioctl [ 176.393932] QAT: Invalid ioctl [ 176.397132] QAT: Invalid ioctl [ 176.400335] QAT: Invalid ioctl [ 176.403537] QAT: Invalid ioctl [ 176.406730] QAT: Invalid ioctl [ 176.409919] QAT: Invalid ioctl [ 176.413117] QAT: Invalid ioctl [ 176.416311] QAT: Invalid ioctl [ 176.419499] QAT: Invalid ioctl [ 176.422688] QAT: Invalid ioctl [ 176.425879] QAT: Invalid ioctl [ 176.429071] QAT: Invalid ioctl [ 176.432263] QAT: Invalid ioctl [ 176.435451] QAT: Invalid ioctl [ 176.438637] QAT: Invalid ioctl [ 176.441828] QAT: Invalid ioctl [ 176.445025] QAT: Invalid ioctl [ 176.448224] QAT: Invalid ioctl [ 176.451424] QAT: Invalid ioctl [ 176.454623] QAT: Invalid ioctl [ 176.457820] QAT: Invalid ioctl [ 176.461019] QAT: Invalid ioctl [ 176.464210] QAT: Invalid ioctl [ 176.467397] QAT: Invalid ioctl [ 176.470584] QAT: Invalid ioctl [ 176.838789] binder_alloc: binder_alloc_mmap_handler: 16973 20001000-20004000 already mapped failed -16 [ 176.851635] binder: BINDER_SET_CONTEXT_MGR already set [ 176.856966] binder: 16973:17022 ioctl 40046207 0 returned -16 [ 176.857007] binder_alloc: 16973: binder_alloc_buf, no vma [ 176.868455] binder: 16973:17023 transaction failed 29189/-3, size 24-8 line 2967 [ 176.879692] binder: 16973:17023 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 176.879771] binder: undelivered TRANSACTION_ERROR: 29189 03:01:18 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x300, 0x0, &(0x7f0000000500)}) 03:01:18 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0x2}], 0x1, 0x0) 03:01:18 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3, 0x0, 0x1, 0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000]}) 03:01:18 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-384-generic)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002940)=[{0x0, 0x3f000000, &(0x7f00000026c0), 0x0, &(0x7f0000002780)}], 0x1500, 0x0) 03:01:18 executing program 4: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREAD(r1, &(0x7f0000000540)={0xc8, 0x75, 0x1, {0xbd, "5d87ff4692b7f310b1a5fe97adbba882b344968f01cb1fda719b7c4befab8ebf395505c405c6258c1f56737e4672198c15c33c70dc08bb448713b0308749ece2963b94dd010fd978b7d9f3b2e7a10c0cce39c330c85f7caa6c3b3c73cb8d9626dc8ca08b1c349717225c4a89d39dfaada4eb0133cd15b005744ceb67ed6dc0abe3ef02014ef046fc82423a6c2768ebdb05dd7f82548a8ab87fda729d1bb9256c63c3b2d669ea6579fd30989253b5609f876c24b696eb8d752efbadd2fb"}}, 0xc8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)="3970d8", 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 03:01:18 executing program 1: r0 = creat(&(0x7f0000000080)='./file0\x00', 0x2) ioctl$TIOCCBRK(r0, 0x5428) set_tid_address(&(0x7f0000000040)) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000200)={@empty, r2}, 0x14) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000000)={@remote={0xfe, 0x80, [], 0xbb}, r2}, 0x14) 03:01:18 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000180)={0x400000000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000}) 03:01:18 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r2}) r3 = eventfd(0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x4) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r3}) [ 176.989777] binder: send failed reply for transaction 499, target dead 03:01:18 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000000)={@empty, r1}, 0x14) fcntl$getownex(r0, 0x10, &(0x7f0000000400)={0x0, 0x0}) ptrace$getregset(0x4204, r2, 0x202, &(0x7f00000004c0)={&(0x7f0000000440)=""/114, 0x72}) r3 = accept4$unix(0xffffffffffffff9c, &(0x7f0000000140), &(0x7f0000000300)=0x6e, 0x80000) accept4$unix(r3, &(0x7f0000000340), &(0x7f00000003c0)=0x6e, 0x80800) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=0xc) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000200)={{{@in=@dev={0xac, 0x14, 0x14, 0xd}, @in6=@dev={0xfe, 0x80, [], 0x20}, 0x4e22, 0xe0000000000, 0x4e22, 0x2, 0xa, 0xa0, 0x80, 0x3c, r1, r4}, {0x80, 0x100, 0x0, 0x68d, 0x0, 0x6, 0x9, 0x1000}, {0x0, 0x35, 0xfffffffffffffff8, 0xf8}, 0xfffffffffffffff7, 0x6e6bb7, 0x2, 0x1, 0x3, 0x2}, {{@in=@multicast1=0xe0000001, 0x4d4, 0x3f}, 0x2, @in, 0x3506, 0x3, 0x1, 0x10000, 0x80000000, 0xef4, 0x6}}, 0xe8) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x400, 0x1) r5 = geteuid() r6 = getgid() lchown(&(0x7f0000000080)='./file0\x00', r5, r6) [ 177.049320] ================================================================== [ 177.056742] BUG: KASAN: use-after-free in irq_bypass_register_consumer+0x4e1/0x550 [ 177.064458] Read of size 8 at addr ffff8801d2fc56f8 by task syz-executor3/17039 [ 177.071899] [ 177.073542] CPU: 0 PID: 17039 Comm: syz-executor3 Not tainted 4.18.0-rc3-next-20180706+ #1 [ 177.081945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 177.091299] Call Trace: [ 177.093897] dump_stack+0x1c9/0x2b4 03:01:18 executing program 2: r0 = socket$inet(0x2, 0x8008000000003, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0xffe5) sendmmsg$unix(r0, &(0x7f0000000380)=[{&(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000440)="6714", 0x2}], 0x1, &(0x7f00000001c0), 0x0, 0x7}], 0x1, 0x0) [ 177.097540] ? dump_stack_print_info.cold.2+0x52/0x52 [ 177.102738] ? printk+0xa7/0xcf [ 177.106024] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 177.110794] ? irq_bypass_register_consumer+0x4e1/0x550 [ 177.116171] print_address_description+0x6c/0x20b [ 177.121029] ? irq_bypass_register_consumer+0x4e1/0x550 [ 177.126400] kasan_report.cold.7+0x242/0x30d [ 177.130822] __asan_report_load8_noabort+0x14/0x20 [ 177.135764] irq_bypass_register_consumer+0x4e1/0x550 [ 177.140965] ? __disconnect+0x1b0/0x1b0 [ 177.144957] kvm_irqfd+0x198e/0x1ef0 03:01:18 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) pwrite64(r0, &(0x7f0000000000)="b74be638d48379f57c64b26a9f5e3e080d41745446b28b69d559f8dd598d1781a74638b1cfc3a7137047a5f5087afdd6dc2a84ce127c18a18200a3a7d6965f9cb07fa03806d34b61d453162a7949253d8abd8094d37c7a7bc948286ec2b847dbda4959a29730b9dbbbbd15c68c12cf0de795a5", 0x73, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f0000000200)={@empty, r1}, 0x14) [ 177.148690] ? kvm_eventfd_init+0x2c0/0x2c0 [ 177.153022] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 177.158568] ? futex_wait_queue_me+0x553/0x830 [ 177.163251] ? refill_pi_state_cache.part.8+0x320/0x320 [ 177.168633] ? kasan_check_write+0x14/0x20 [ 177.172880] ? do_raw_spin_lock+0xc1/0x200 [ 177.177130] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 177.182678] ? lock_acquire+0x1e4/0x540 [ 177.186643] ? __might_fault+0x12b/0x1e0 [ 177.190692] ? lock_downgrade+0x8f0/0x8f0 [ 177.194829] ? lock_release+0xa30/0xa30 [ 177.198794] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 177.203971] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 177.209504] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 177.215027] ? _copy_from_user+0xdf/0x150 [ 177.219174] kvm_vm_ioctl+0xf80/0x1d80 [ 177.223049] ? drop_futex_key_refs.isra.14+0x6d/0xe0 [ 177.228138] ? futex_wake+0x304/0x760 [ 177.231942] ? __perf_event_task_sched_in+0x24f/0xbb0 [ 177.237119] ? kvm_set_memory_region+0x50/0x50 [ 177.241707] ? perf_trace_lock_acquire+0xeb/0x9a0 [ 177.246540] ? perf_trace_lock+0x920/0x920 [ 177.250761] ? lock_downgrade+0x8f0/0x8f0 [ 177.254901] ? finish_task_switch+0x18a/0x870 [ 177.259392] ? do_futex+0x249/0x27d0 [ 177.267799] ? kasan_check_read+0x11/0x20 [ 177.271951] ? do_raw_spin_unlock+0xa7/0x2f0 [ 177.276343] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 177.280914] ? compat_start_thread+0x80/0x80 [ 177.285312] ? exit_robust_list+0x290/0x290 [ 177.289617] ? finish_task_switch+0x1d3/0x870 [ 177.294098] ? lock_acquire+0x1e4/0x540 [ 177.298055] ? __fget+0x4ac/0x740 [ 177.301494] ? lock_downgrade+0x8f0/0x8f0 [ 177.305627] ? lock_release+0xa30/0xa30 [ 177.309596] ? __schedule+0x884/0x1ed0 [ 177.313472] ? __fget+0x4d5/0x740 [ 177.316919] ? ksys_dup3+0x690/0x690 [ 177.320621] ? kasan_check_write+0x14/0x20 [ 177.324839] ? do_raw_spin_lock+0xc1/0x200 [ 177.329061] ? trace_hardirqs_off_caller+0x250/0x2c0 [ 177.334147] ? _raw_spin_unlock_irqrestore+0x63/0xc0 [ 177.339239] ? kvm_set_memory_region+0x50/0x50 [ 177.343805] do_vfs_ioctl+0x1de/0x1720 [ 177.347682] ? ioctl_preallocate+0x300/0x300 [ 177.352073] ? __fget_light+0x2f7/0x440 [ 177.356032] ? __schedule+0x1ed0/0x1ed0 [ 177.359989] ? fget_raw+0x20/0x20 [ 177.363441] ? trace_hardirqs_on+0xd/0x10 [ 177.367574] ? kmem_cache_free+0x22e/0x2d0 [ 177.371800] ? __x64_sys_futex+0x47f/0x6a0 [ 177.376026] ? do_futex+0x27d0/0x27d0 [ 177.379815] ? security_file_ioctl+0x94/0xc0 [ 177.384217] ksys_ioctl+0xa9/0xd0 [ 177.387657] __x64_sys_ioctl+0x73/0xb0 [ 177.391533] do_syscall_64+0x1b9/0x820 [ 177.395406] ? finish_task_switch+0x1d3/0x870 [ 177.399905] ? syscall_return_slowpath+0x5e0/0x5e0 [ 177.404822] ? syscall_return_slowpath+0x31d/0x5e0 [ 177.409748] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 177.414754] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 177.419587] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 177.424760] RIP: 0033:0x455e29 [ 177.427929] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 177.447217] RSP: 002b:00007fab3340dc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 177.454918] RAX: ffffffffffffffda RBX: 00007fab3340e6d4 RCX: 0000000000455e29 [ 177.462183] RDX: 0000000020000180 RSI: 000000004020ae76 RDI: 0000000000000018 [ 177.469435] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 177.476686] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 177.483940] R13: 00000000004bdf94 R14: 00000000004cc800 R15: 0000000000000000 [ 177.491200] [ 177.492812] Allocated by task 17039: [ 177.496528] save_stack+0x43/0xd0 [ 177.499966] kasan_kmalloc+0xc4/0xe0 [ 177.503664] kmem_cache_alloc_trace+0x152/0x780 [ 177.508316] kvm_irqfd+0x18f/0x1ef0 [ 177.511926] kvm_vm_ioctl+0xf80/0x1d80 [ 177.515799] do_vfs_ioctl+0x1de/0x1720 [ 177.519667] ksys_ioctl+0xa9/0xd0 [ 177.523104] __x64_sys_ioctl+0x73/0xb0 [ 177.526975] do_syscall_64+0x1b9/0x820 [ 177.530846] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 177.536011] [ 177.537623] Freed by task 13: [ 177.540713] save_stack+0x43/0xd0 [ 177.544150] __kasan_slab_free+0x11a/0x170 [ 177.548376] kasan_slab_free+0xe/0x10 [ 177.552162] kfree+0xd9/0x260 [ 177.555252] irqfd_shutdown+0x144/0x1c0 [ 177.559209] process_one_work+0xc73/0x1ba0 [ 177.563425] worker_thread+0x189/0x13c0 [ 177.567382] kthread+0x345/0x410 [ 177.570729] ret_from_fork+0x3a/0x50 [ 177.574418] [ 177.576030] The buggy address belongs to the object at ffff8801d2fc5580 [ 177.576030] which belongs to the cache kmalloc-512 of size 512 [ 177.588682] The buggy address is located 376 bytes inside of [ 177.588682] 512-byte region [ffff8801d2fc5580, ffff8801d2fc5780) [ 177.600535] The buggy address belongs to the page: [ 177.605448] page:ffffea00074bf140 count:1 mapcount:0 mapping:ffff8801da800940 index:0x0 [ 177.613573] flags: 0x2fffc0000000100(slab) [ 177.617803] raw: 02fffc0000000100 ffffea0006a938c8 ffffea0007294088 ffff8801da800940 [ 177.625671] raw: 0000000000000000 ffff8801d2fc5080 0000000100000006 0000000000000000 [ 177.633528] page dumped because: kasan: bad access detected [ 177.639213] [ 177.640818] Memory state around the buggy address: [ 177.645732] ffff8801d2fc5580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 177.653072] ffff8801d2fc5600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 177.660412] >ffff8801d2fc5680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 177.667751] ^ [ 177.675009] ffff8801d2fc5700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 177.682351] ffff8801d2fc5780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 177.689777] ================================================================== [ 177.697609] Kernel panic - not syncing: panic_on_warn set ... [ 177.697609] [ 177.704979] CPU: 0 PID: 17039 Comm: syz-executor3 Tainted: G B 4.18.0-rc3-next-20180706+ #1 [ 177.714767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 177.724107] Call Trace: [ 177.726682] dump_stack+0x1c9/0x2b4 [ 177.730293] ? dump_stack_print_info.cold.2+0x52/0x52 [ 177.735476] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 177.740227] panic+0x238/0x4e7 [ 177.743404] ? add_taint.cold.5+0x16/0x16 [ 177.747543] ? do_raw_spin_unlock+0xa7/0x2f0 [ 177.751933] ? do_raw_spin_unlock+0xa7/0x2f0 [ 177.756323] ? irq_bypass_register_consumer+0x4e1/0x550 [ 177.761669] kasan_end_report+0x47/0x4f [ 177.765627] kasan_report.cold.7+0x76/0x30d [ 177.769932] __asan_report_load8_noabort+0x14/0x20 [ 177.774840] irq_bypass_register_consumer+0x4e1/0x550 [ 177.780016] ? __disconnect+0x1b0/0x1b0 [ 177.783976] kvm_irqfd+0x198e/0x1ef0 [ 177.787685] ? kvm_eventfd_init+0x2c0/0x2c0 [ 177.791996] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 177.797515] ? futex_wait_queue_me+0x553/0x830 [ 177.802080] ? refill_pi_state_cache.part.8+0x320/0x320 [ 177.807426] ? kasan_check_write+0x14/0x20 [ 177.811642] ? do_raw_spin_lock+0xc1/0x200 [ 177.815861] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 177.821381] ? lock_acquire+0x1e4/0x540 [ 177.825335] ? __might_fault+0x12b/0x1e0 [ 177.829377] ? lock_downgrade+0x8f0/0x8f0 [ 177.833507] ? lock_release+0xa30/0xa30 [ 177.837462] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 177.842632] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 177.848154] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 177.853675] ? _copy_from_user+0xdf/0x150 [ 177.857806] kvm_vm_ioctl+0xf80/0x1d80 [ 177.861675] ? drop_futex_key_refs.isra.14+0x6d/0xe0 [ 177.866766] ? futex_wake+0x304/0x760 [ 177.870548] ? __perf_event_task_sched_in+0x24f/0xbb0 [ 177.875730] ? kvm_set_memory_region+0x50/0x50 [ 177.880295] ? perf_trace_lock_acquire+0xeb/0x9a0 [ 177.885121] ? perf_trace_lock+0x920/0x920 [ 177.889339] ? lock_downgrade+0x8f0/0x8f0 [ 177.893468] ? finish_task_switch+0x18a/0x870 [ 177.897947] ? do_futex+0x249/0x27d0 [ 177.901641] ? kasan_check_read+0x11/0x20 [ 177.905768] ? do_raw_spin_unlock+0xa7/0x2f0 [ 177.910329] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 177.914892] ? compat_start_thread+0x80/0x80 [ 177.919293] ? exit_robust_list+0x290/0x290 [ 177.923594] ? finish_task_switch+0x1d3/0x870 [ 177.928079] ? lock_acquire+0x1e4/0x540 [ 177.932031] ? __fget+0x4ac/0x740 [ 177.935464] ? lock_downgrade+0x8f0/0x8f0 [ 177.939593] ? lock_release+0xa30/0xa30 [ 177.943553] ? __schedule+0x884/0x1ed0 [ 177.947423] ? __fget+0x4d5/0x740 [ 177.950882] ? ksys_dup3+0x690/0x690 [ 177.954579] ? kasan_check_write+0x14/0x20 [ 177.958793] ? do_raw_spin_lock+0xc1/0x200 [ 177.963016] ? trace_hardirqs_off_caller+0x250/0x2c0 [ 177.968102] ? _raw_spin_unlock_irqrestore+0x63/0xc0 [ 177.973187] ? kvm_set_memory_region+0x50/0x50 [ 177.977767] do_vfs_ioctl+0x1de/0x1720 [ 177.981638] ? ioctl_preallocate+0x300/0x300 [ 177.986037] ? __fget_light+0x2f7/0x440 [ 177.989992] ? __schedule+0x1ed0/0x1ed0 [ 177.993948] ? fget_raw+0x20/0x20 [ 177.997381] ? trace_hardirqs_on+0xd/0x10 [ 178.001520] ? kmem_cache_free+0x22e/0x2d0 [ 178.005737] ? __x64_sys_futex+0x47f/0x6a0 [ 178.009962] ? do_futex+0x27d0/0x27d0 [ 178.013746] ? security_file_ioctl+0x94/0xc0 [ 178.018135] ksys_ioctl+0xa9/0xd0 [ 178.021568] __x64_sys_ioctl+0x73/0xb0 [ 178.025439] do_syscall_64+0x1b9/0x820 [ 178.029319] ? finish_task_switch+0x1d3/0x870 [ 178.033795] ? syscall_return_slowpath+0x5e0/0x5e0 [ 178.038705] ? syscall_return_slowpath+0x31d/0x5e0 [ 178.043615] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 178.048616] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 178.053440] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 178.058621] RIP: 0033:0x455e29 [ 178.061789] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 178.080956] RSP: 002b:00007fab3340dc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 178.088645] RAX: ffffffffffffffda RBX: 00007fab3340e6d4 RCX: 0000000000455e29 [ 178.095893] RDX: 0000000020000180 RSI: 000000004020ae76 RDI: 0000000000000018 [ 178.103143] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 178.110393] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 178.117642] R13: 00000000004bdf94 R14: 00000000004cc800 R15: 0000000000000000 [ 178.125341] Dumping ftrace buffer: [ 178.128860] (ftrace buffer empty) [ 178.132547] Kernel Offset: disabled [ 178.136148] Rebooting in 86400 seconds..