0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000]}) 12:00:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x4800, &(0x7f0000000480)="bce854e9"}) [ 438.048722] binder: 17371:17377 got reply transaction with no transaction stack [ 438.074421] binder: BINDER_SET_CONTEXT_MGR already set 12:00:50 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xfc00000000000000]}}, 0x1c) 12:00:50 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xeb, 0x400000000000) 12:00:50 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) [ 438.101090] binder: 17371:17385 got reply transaction with no transaction stack [ 438.127208] binder: 17371:17377 ioctl 40046207 0 returned -16 [ 438.148913] binder_thread_release: 4 callbacks suppressed [ 438.148937] binder: release 17371:17377 transaction 739 out, still active 12:00:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0xa, &(0x7f0000000480)="bce854e9"}) [ 438.210163] XFS (loop3): Invalid superblock magic number [ 438.245348] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:00:50 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f]}) 12:00:50 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xf2, 0x400000000000) [ 438.265313] binder_send_failed_reply: 4 callbacks suppressed [ 438.265320] binder: send failed reply for transaction 739, target dead [ 438.297904] binder: 17406:17407 got reply transaction with no transaction stack [ 438.389755] binder_alloc_mmap_handler: 4 callbacks suppressed [ 438.389773] binder_alloc: binder_alloc_mmap_handler: 17406 20001000-20004000 already mapped failed -16 [ 438.406361] binder: BINDER_SET_CONTEXT_MGR already set [ 438.426490] binder: 17406:17407 ioctl 40046207 0 returned -16 [ 438.441204] binder_alloc_new_buf_locked: 4 callbacks suppressed [ 438.441212] binder_alloc: 17406: binder_alloc_buf, no vma [ 438.443701] binder: 17406:17424 got reply transaction with no transaction stack [ 438.554765] binder: send failed reply for transaction 744 to 17406:17407 [ 438.563735] binder_release_work: 4 callbacks suppressed [ 438.563740] binder: undelivered TRANSACTION_COMPLETE 12:00:50 executing program 0: r0 = socket$inet6(0xa, 0x0, 0x1) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000000)=ANY=[@ANYBLOB="0000040000000000581e6946570e713b13aae579d16581b7fb55e47e5e883237ba796a00460679e9d422902aac6b8258f0673c5a99a37bd0e3a408086cfd86918f82a1b0eb923fccc203c1b884299c3ffa844e6fd6d6315392e0f98c0320490766a338efec87a27e51d764578ae5ade7463253aa2105ab47446d4664f2243c7e6f6bb62e05933e7ef46216d54f6385ccaee7b6411b93a72dda123f87d8209cddafe2940e8eac72affa9ce36033087d45f6a98253af5a3db95466638351be7f082cb104b3"], 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:00:50 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x40000000]}}, 0x1c) 12:00:50 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfsl', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:00:50 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) 12:00:50 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x71, 0x400000000000) 12:00:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x6800000000000000, &(0x7f0000000480)="bce854e9"}) [ 438.676601] binder: 17435:17436 got reply transaction with no transaction stack [ 438.705105] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:00:50 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) 12:00:50 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xda, 0x400000000000) 12:00:50 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x700000000000000]}}, 0x1c) [ 438.729237] binder: 17435:17436 ioctl c0306201 200001c0 returned -14 [ 438.753792] binder_alloc: binder_alloc_mmap_handler: 17435 20001000-20004000 already mapped failed -16 [ 438.802227] binder: BINDER_SET_CONTEXT_MGR already set [ 438.833363] binder: 17435:17464 got reply transaction with no transaction stack 12:00:50 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) setsockopt$RDS_CONG_MONITOR(r2, 0x114, 0x6, &(0x7f0000000040)=0x1, 0x4) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000340)={{{@in=@rand_addr, @in=@loopback}}, {{@in=@remote}, 0x0, @in=@rand_addr}}, &(0x7f0000000240)=0xe8) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000280)=ANY=[@ANYBLOB="00e903000008000057a2c93db20fb6b6a0a566f53c8260eb6550b0ed76c9881952cb456fa062dde86934964e1b8a70f2716fea39a0435d190d2b9693bf2f2c87a156c756619f9dd479408d9240413df23d34b261e7e201b244d11e2b7872d834f40240545c09d089c3978c087b2c83b9f51826742e7a53f7108fc0a493fbfcb733f88aeb312f17a94fdbe17244508bd4b91c130c35ae69805cc8cb2bc3f69a495800000000000000000000000000000000"], 0x8) write$P9_RAUTH(r2, &(0x7f0000000200)={0x14, 0x67, 0x1, {0xd0, 0x4}}, 0x14) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) getsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000180)=0x6, &(0x7f00000001c0)=0x1) getpeername$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local}, &(0x7f0000000140)=0x1c) ioctl$BLKRESETZONE(r2, 0x40101283, &(0x7f0000000080)={0xfff, 0x57}) 12:00:50 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) [ 438.884666] binder: 17435:17436 ioctl 40046207 0 returned -16 [ 438.917573] binder_alloc: 17435: binder_alloc_buf, no vma 12:00:50 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:00:50 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1d9, 0x400000000000) [ 438.949415] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 438.972097] binder: 17435:17464 ioctl c0306201 200001c0 returned -14 [ 438.979366] binder: release 17435:17436 transaction 749 out, still active [ 439.004346] binder: undelivered TRANSACTION_COMPLETE 12:00:51 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x8dffffff]}}, 0x1c) 12:00:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x1000000, &(0x7f0000000480)="bce854e9"}) 12:00:51 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000]}) [ 439.094887] binder: send failed reply for transaction 749, target dead [ 439.168999] binder: 17501:17502 got reply transaction with no transaction stack [ 439.187427] binder: 17501:17502 ioctl c0306201 200001c0 returned -14 [ 439.198291] XFS (loop3): Invalid superblock magic number 12:00:51 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x8010017d]}}, 0x1c) 12:00:51 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x129, 0x400000000000) [ 439.217576] binder_alloc: binder_alloc_mmap_handler: 17501 20001000-20004000 already mapped failed -16 12:00:51 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) [ 439.307408] binder: BINDER_SET_CONTEXT_MGR already set [ 439.309843] binder: 17501:17524 got reply transaction with no transaction stack [ 439.329348] binder: 17501:17502 ioctl 40046207 0 returned -16 12:00:51 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfsP', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:00:51 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xffffffffffffffff]}}, 0x1c) [ 439.356504] binder_alloc: 17501: binder_alloc_buf, no vma [ 439.361389] binder: 17501:17524 ioctl c0306201 200001c0 returned -14 [ 439.370418] binder: release 17501:17502 transaction 754 out, still active [ 439.389140] binder: undelivered TRANSACTION_COMPLETE [ 439.434970] binder: send failed reply for transaction 754, target dead 12:00:51 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1f63588e, 0x40) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer2\x00', 0x44000, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000040)={0x1, 0x17, 0x2, {0x7, './file0'}}, 0x10) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000140)={0x80000001, {0x2, 0x4e24, @multicast2}, {0x2, 0x4e23, @rand_addr=0x2}, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x10}}, 0x0, 0x9, 0x7fff, 0xd65e0000000, 0x3, &(0x7f0000000080)='team_slave_0\x00', 0x80, 0x20, 0x4}) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=ANY=[@ANYBLOB="0000040062000000"], 0x8) getitimer(0x2, &(0x7f00000000c0)) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000000240)="f9098c08abde862627d8fd6fd9054f1cacbc", 0x12) 12:00:51 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x64, 0x400000000000) 12:00:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x20000000, &(0x7f0000000480)="bce854e9"}) 12:00:51 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) 12:00:51 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x8]}}, 0x1c) 12:00:51 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x18d, 0x400000000000) [ 439.649952] binder: 17543:17544 ioctl c0306201 200001c0 returned -14 [ 439.672600] binder_alloc: binder_alloc_mmap_handler: 17543 20001000-20004000 already mapped failed -16 12:00:51 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x7fdc]}}, 0x1c) 12:00:51 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f]}) 12:00:51 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs4', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 439.704068] binder: BINDER_SET_CONTEXT_MGR already set [ 439.709985] binder: 17543:17544 ioctl 40046207 0 returned -16 [ 439.716172] binder: 17543:17563 ioctl c0306201 200001c0 returned -14 [ 439.723008] binder: release 17543:17544 transaction 759 out, still active [ 439.757005] binder: undelivered TRANSACTION_COMPLETE 12:00:51 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x14280000000000]}}, 0x1c) 12:00:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x4c, &(0x7f0000000480)="bce854e9"}) [ 439.864694] binder: send failed reply for transaction 759, target dead 12:00:51 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x16e, 0x400000000000) [ 439.972141] binder_alloc: binder_alloc_mmap_handler: 17586 20001000-20004000 already mapped failed -16 [ 439.974983] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 440.058128] binder: BINDER_SET_CONTEXT_MGR already set [ 440.088229] binder: 17586:17588 ioctl 40046207 0 returned -16 [ 440.124276] binder: release 17586:17588 transaction 763 out, still active [ 440.134625] binder: undelivered TRANSACTION_COMPLETE [ 440.224769] binder: send failed reply for transaction 763, target dead 12:00:52 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000013c0)={'team0\x00', 0x0}) sendmmsg(r0, &(0x7f0000002e80)=[{{&(0x7f0000000000)=@llc={0x1a, 0x18, 0x5e, 0xbeb7, 0xffff, 0x5, @link_local}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000080)="7df0a5ae5838dd5f22f53817d3c35fed02b8dc957c96fcdb376a831d96e442590b8716ca7dfee6fc7f0bb02dead73110", 0x30}], 0x1, &(0x7f0000000200)=[{0x90, 0x113, 0xa6, "b6d5bb6cef81fc665dd0a509255e052cb8fcf9a52349eed2f1fdcebceb65ec0a3307ff7c651598b40c931f0e81c54204b59cd8978422f4eb52a0f2054658c552a73fe50f5ca610d43d2fc5ad9285bfeb3bb49fd9f23a98939e3531ae297ecc495b6766c3903061ae91df3469102e40674e60c3177253733c251119d1fd"}, {0x60, 0x104, 0x6, "b126c3fc485b2c39e73cb3ba5f770c7fafb5fa5cda59922041fcf1f2f6e2ead21c7cd45c284b4d3dddcd93769dc6800fb25f55aa198cdb854bc5b480d86729ee6de731acd8d416d9dd2a2b095a"}], 0xf0, 0x4000}, 0x800}, {{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000140)="8bb3dde342f1762288d7cf6af6cc8cc95d269914", 0x14}], 0x1, 0x0, 0x0, 0x80}, 0x81}, {{&(0x7f0000000300)=@pppoe={0x18, 0x0, {0x0, @random="facb9e6086b6", 'bond_slave_0\x00'}}, 0x80, &(0x7f0000000800)=[{&(0x7f0000000380)="0ae574555ff8ed377ff00716faa5c94bad69b209935a3364a9b40e1e6a9029fa2d1387b2ec9b2b420f9fee60cd19b2cfbfdad4facab61559e12b70214a1bcd825cf7e65b6ba04a568883eda324266e35b34eaf4b66d61b388a26127c5bc72746ae6a11f8bae69b7f2134db5836ed247d95107586dcdec9f94d458265bfecd5d802f1ff6c6139b589", 0x88}, {&(0x7f0000000440)="50ecadce252d519078339dd9d768b7f1b760b1989d6fa17e08e241699571f10a00838c5de3d04f5545ce41888345af1495c02e1bb1da65f689e73dc231d40ae9fc603d1f4521df22c786827a83a1bc3f55cada9af3f63d7e8006e85767eded09bb8a4f724623799202028cf65f7a1f6add6c7ad140a9dc2977", 0x79}, {&(0x7f00000004c0)="430edeef1a882ce4609fdea8d34361b1cacdfb8603f1320f4c68444df5639ee1492e27b3f51bea9cda2817eab9c2365ea316bc5008e83a51b71ce9588bd0852305dadd92cdf1f024f3e061249e5864466e9f7655dfa0f3e2599b9f58e3536653814e23da1f0f7bd5a80bf06ec795937d1fa1151f2df829f36bd55a621dc5c1ee25a05d1ac094849a675ec2dc3a200113a7c4187417861d5bf8a3fa9bebdf9a606a08c9658397941ba9cbaf09cc68a659dce9e42d2f129d5e5a057450", 0xbc}, {&(0x7f0000000580)="1486d1f7d5d792088a48eac1a1a94447b5ceb183c0e4593b96b26663db13b97c656556bd3914b1f225e831d40b11f7a4afd877a04c5f65a3db4ecc6f3f4782daf31f4de8069b89454fe71a860655812d67e28e96c9fa7ed610ab923a4921e8ce158fad0fedfd267909dfb65f10dabec1c57b5da3fe3534fed3a203975a46de7f582e53df0a6036bccf2bb8b58c52566ee5a9bb17069cbc19792fd855b78497459cc55ea78d50846a3f8fc24ea9eb3d86cafc355c4245af397602bc93a35b62c1d58cbe9076ec47abf8b245aa552dd4db1ad051107f65db6207f75f451d48da6b579b2ab1", 0xe4}, {&(0x7f0000000680)="f4530f46524602c2fbd2ea911a45c14abedac913dda8c3b303267b10c43c641d361af36a7bfa2cd406de61cb545c95c467e18d39e92e03e3f9d035af2ad4", 0x3e}, {&(0x7f00000006c0)="60c403f7dc0fb09354cd1c477599c64a909489b0dced53603920c982a0d0ebc386ac9d21b40e890b", 0x28}, {&(0x7f0000000700)="617dc7caa5f6294d1110ee93435f3bec789329379e1c328ab401cfa46351b74ced64b7d7c16d001c35df16c21628b368675f8884a645f71c95995cd2d5dfd24ebdbc77da08fd7808e12d5fc913b2f487aa318ec9a079190d8028fae6490f69c1e5aa7e8294b7a7d310430c8a1fd0f924e8525d2f4b139f1aa64c6591c165ec490f995e279963159c9d3525b3f7e0f5ade3de71560056e75983e475ac20d9f61180905c8c204deeae9f369a68157c200e6c39543d1f67e6ba82a53e573023c8912ff2358e10a1f04ecd98bfedc32c7f", 0xcf}], 0x7, 0x0, 0x0, 0x48000}, 0x6}, {{&(0x7f0000000880)=@vsock={0x28, 0x0, 0x2710, @host}, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000900)="e3bca910fe5c9781cb0c2de1f45c44927d4594ad3d2204f6b1b26d4a1e8c20ed17f1f39d912f30a53910d054ede1ebeebb5435481211bfac5cec64ce50839666c8bb4c09c8a775850116aafca99fd52847d7bb71eea053b5c6c52b60f511665bdd1b36c6f42dba555945bc29ef17ff0e37ae8d31f5408b50a4b065d94c0c5357a211c9fbd8bd79aee2d1f88c736d06e4ea01cd509a2e9c231e865c02ee1636", 0x9f}, {&(0x7f00000009c0)="e5e9f0b8cb546fcf1bf6c51bcb29ef8c9498a09c0cb4809a8acf2f2e3c10087bbb48e6389e9ed015c7cbaf", 0x2b}, {&(0x7f0000000a00)="8b73203212b17d50b1e98db42223795dde07ff2cbde258071c39e187c3e69aa4fb6c9a08937e8f3f4aef5421552e846d5efebb5b91cc460abc804f1dfc675706a1a5b77cfb8f77dc4316cb08aa073aed563049ba284de641", 0x58}], 0x3, &(0x7f0000000ac0)=[{0x70, 0x11, 0x6, "838d3afd78b1e227cb1af29e4e067ec13b9458ee14c592547a7275784ea0d7e5efea1ec7603b91324fb2159a37f491b722f385b188b20c93331b69662694ffc48f381c23ebb3533d280ffccaf2ed6de1b81e7adc4e810bd6c1552746"}, {0xa8, 0x112, 0x3, "668d90a3e6faad17f6030295fcaba32da1f90aaccfd0c000c5bc3e7587cb49d7186fcdfdf888b9a0468d28463d42493b04e93daf650beec5cbb2a71d481d53a97e73832080641592f12b369ad0aee035a1533ccac6c36fc9651907f1f16643d3449d6084d0caae647bfd41626eb0a1efaa08aeb269e30b1f9452a24dd76748a09d0cab068da009bb339d0afbb131803532ee"}, {0x10, 0x11f, 0xa3b}, {0xd0, 0xff, 0x6, "42977f545c47f1323def69f694f09bcce47dee22db35c952f35e2e1e894dfc6f67bbf74ca95498d5c5ccf7a948751696aed4a6f2fca63e2c804a0c5c04b8c43069c849ec78d8943e2ce364321204fe2c8d150adeaa9f04a13c891073503dc227aaadf411b63b0562b8eabdb61e069756b85bc1d70322b260668aeb0786f5f27793cecd8773c7306edb34a715ea95861879ebeea72387103d955176d5e99e892b56001a16e01dec79670b8132662d1fc859b9560ae324b789b0b8f1a959b91d"}, {0x78, 0x3a, 0x0, "89745d5e4705170af5e2093b701fd945bfbae59e5405cdf0411eed2e1350ad49039200c13ccde51b5aac9bbf34585667c268e72bda1d4fdac199125770a3711231520d751043a2e0fe8d86d476b275769f9cee245125bce2d7a0fe3e3fd89d20589404e59b85dc74"}, {0x110, 0x113, 0x8, "406471c2fdd70aa3907a3a3045479b37042e041447bda4c5c19e5a005f581e82b23891c639c0e6031fa43df37f13b2025f132823b112c975554d486e5514ce85f5aab0beb94a3d0d498a10b5e57bcff0129c86ba81b0b0f2b83ac604597dd8fe990357763f36f3c73c282e5ed192bc98ebef9cc33409bcbaac7c6dad8f6062b89928692fb5c5055c83acdd2f63588178f26e16f8936b26aa989ba9655c60112efda4d42d5e47372c443f5a5c89aacba8aa6a06adea395e7197ac86d3cec968a793b2680480eb098dd0608795212d86d8b090f32540cc28dde59b0d03f6e2fb0071f00e85044eaf2e767e7e6127df83a70eb9a4c809ba3ee99fdb4b84"}, {0xe8, 0x0, 0x7, "257c2b07f542b8e7b1eeca5dade72a3fd64df3831bf2c887e521a3e7287fc457df3df921098f8c3d4ec21416a2d35daab7af08df556d8fe7dd42d08cac10978a6c09151eaae51d33210b78cd6ac1466d8ef1300af0c83d3630872cf5ca60b62449f99c6a90cf05303de10a119d0184045441d272dc2dd09b5ba22fe929b1c36de1fece71e782cf66791d18d79fbfc0e71086dd60a65e3d95ed4489ffe8618d8c6238ae1d5fcb174191082718922beda64a35df4fcc5097f1da21a09248f33203eb537551b499003bda4b9a0ec0d2315e39421470f5171046"}], 0x468, 0x80}, 0x10000}, {{0x0, 0x0, &(0x7f0000000fc0)=[{&(0x7f0000000f40)="8d6b3f59487608187ae657eb9f9558c421e2c422fb1387950927a76dfcef89948836aebadb8dfe54ea85c03c5f5f4baa7b50981aa47bfcc2ecd9e8a564268c04f9d9f397b42bca5fc3e466116fd37e062cd93de7663c5fb5344bb5ed47b8f28ee87ce1286c118984e3353dcb6a7207b7e1501e4cdc", 0x75}], 0x1, 0x0, 0x0, 0x20000000}, 0x81}, {{&(0x7f0000001000)=@generic={0x9, "74c90fbb3bc5912e5d4ebf9443a2633b45ea586176afcfade44d5d0242114c63d63656541bb955d7e434ff13c3875d790b251ed067705c44b865de562585a2e23e3c54f1e9e46425941a90a12b70096a249a1172087e2a2229ad730d902e0b283cbfa5fff1bf6228609d92e4c377f087f66496c5c04d247b69c751129e47"}, 0x80, &(0x7f00000012c0)=[{&(0x7f0000001080)="2545c0e358d69f993cfe1da46660b2129c2bf9f1e16eec8a6e8c02c171cf68993e1a83c3575df1de426c43927e3ff412919ce7f46dd8022849aa98a03c8e14b6ce41712a83e6f5da6487c2", 0x4b}, {&(0x7f0000001100)="7213dc90ee34a6e6af814ba10a046870733554c9933d963ce11aa141a5a161aa606044c0ad2bee69cf1a7bf9c36a6c956c6ab59d9d0da7f4a6754eb3d9be3787b1c231c4cb52ce7d1f63d53616000ef2f4f338b6e43fb78b261eeaaf53a9d7d0df4c75fe00d789f9f0accd7d84ceca07fd5628c02fad92743f91d421863bc62c38d9bf82b8e995627625a23f2cf50ebf656c844e364ec67dccdd5c3642f278093a8e17e7748fc8a27eb66a848338", 0xae}, {&(0x7f00000011c0)="41f66c1e8aba69ad5150faffd5efa37c55698511d725e9dfc7b2cf290a4ab0969162697b90e3bc908d1db78034c45d22ddebf3b383fe32a88bec023f75f0b781088286b3f73a46f7325ab4587020dd1bbecd4c3de7b7ee264f22db90db2ab4065eb271e8b35588aad17c5f289f0e9017e031445228c5cdeb9bf52e3ff9", 0x7d}, {&(0x7f0000001240)="9cbfa40c57a63f02eabff7f58556457e11cfdc29a10681e73d29797d39811ceec2320543d17ea8ba06c91195cc355aa8e23af0a97228336c4e8afb38d88c0c0eaab7e705b8b8da173d890caa43ec42397f006de13e3264dbcbecce002fb0903cf3148413e747e3210a6844", 0x6b}], 0x4, &(0x7f0000001300)=[{0x30, 0x6, 0xfffffffffffffffb, "6e82a6c8af608fa9d03d4c73fda29279f1e2fc43fdb74da867c862421f470377"}, {0x60, 0x109, 0x9, "e9366c3f7980f223d8942fe5c20999e0949eb991309d1e4cc2a870840222cfaa55dce49bc58d4f63f3c66b554d47c8d0ab2e61029809d0a1179ab4c82941048d3095be5687624d407ff63cdcc7"}], 0x90, 0x84}, 0x2}, {{&(0x7f0000001400)=@ll={0x11, 0x16, r1, 0x1, 0x8, 0x6, @dev={[], 0x12}}, 0x80, &(0x7f00000016c0)=[{&(0x7f0000001480)="534007ad88fc5b4bc5ec294ce7f42fca532139eab72e2a05a7d416fe3ca88ffdabce2d40af094d0e902f9d9a82ec6c536b6412f42188f493364c7617d858acee1c9e7a8832d9d92a7fc68d37", 0x4c}, {&(0x7f0000001500)="6db8e0d6e1646646f7407f45b15a2eeb507ec873d56e5931c57e73185977a8fcd68daaa8c64564a96f0ffdbfac044053df0dd8145bd782b11c25fd12640f4b05b6eff7377e98e2651bbf1e18e65395524658", 0x52}, {&(0x7f0000001580)="1b866e8dd3603f3bb2ab121a0a433a1e7f63512f11d29ccb5fe89644b3e75b65980e53e903d077063d301d92c61565567f9d1d3931774ac9a7d26e2a0c053c4686b2d031d0deb3e4f79154154aae3905dc2f42972f47aeb175bb", 0x5a}, {&(0x7f0000001600)="eb9ed3bf27dbc200eec8b8102f29c8999028be9bae4b7e2655c75400ee52e13c3bd48f726200a765d074258f5489c142fef6f30d9aa5433ccf292a81ee882bf878bcb9332373b38b2cd2cd5c56697ccb453f810a191602a4fdff0f53a5248572fbb1558a1f6d1009d64c7b0c03112641273b9b09dba8bcc1b74ba4668553b3bd936260", 0x83}], 0x4, &(0x7f0000001700)=[{0x1010, 0x0, 0x80000001, "1747bfb24e9deb252cc2f44b3f1a3b02de7e62baedce60628652df6b5c357a76b3616ef7558efb560708eb133abcea4790ae1b21f5ca20f3cfdfc916353fab7c4a9e85df12cabfa1b38a32359e5de0b04bd196f91d105d0a0b79af6adc070aa0a3f5d7b64fee7d93862369f9b423c0a08a1ea1a1bc92fb230e1a06c302524c2f1affd55831ac6417887c8039712e56ca26e615231199bea54c0431c891dc8d9f06f6d2867c5e25856ae39bb9ab847749a87daab8c7ae7dfd8d62aa7bebc0d291f1ec629b6f080b225fe63858a3bcbcd2f2c87d6665dcefce49e703837077a7ace56983b52515e41fd589239c00bdf56f68eaa556e938ec5f52ce91d2d9be18d08884e995f1d880f2d219039b2ddbf3c777492099ddce63785de42347b8f7fa11e443e5a9b12e4da614e081cbbbdafeee4c21bb9fbdd30113b07eb0e7e9c867930ed512c59105c8e0a0d4201df64318c0d7212036fc37c8d105c3d638eb8d54172fe4b4fb15dd2e75f15f0f01b034d739fbbf7b4643224fbcce38cf7b13be67fabe0a81f3d0ce6497ee6d039d07b639a794b20d2941347ddb1ec5ad9ecb3743bb20a583335c4311096ff3d79ff29ee1c9e68ca8a3b74d3dd86a6174efcff533b04f84acec50f7f52caf031d34f76fac7064b1143e5e6ff6d4db6f1662213d4de4918e77c9e48c31b7224ad55665acb37c3c58cc845c8ae5584464ddad5e43bbec6275844b9a26081589d3bc19fed137d58abba75c497c0452bf2e706d17f82133498263379c81cc6387b18948cc2bf2ac676f6353b9ba049a2120e492f1fc02398a56fc645c7e8a4db81604039ba65bcaf3ae32b4f90dc0098c8f12df7243322f0797d46fd3e75df493f90e155227903396919ea2c97640b5c7d0ca6b372bab8a9b69b6d0d43f7956c4ba4b0938fe05f7a8da2b76bef1c23477b88438dcb33384451a9220f301d6316651fa4bfbabe88f8db79ea143b94e1c831e5db3a6fd3f84bfbe43f79235e0c3fcd35b29139095becef126687e4c1a0346b5c72086449ec7703a0945eac2867e505ba88790770873cba6b18863a3327dbb53136732f34bb9720edf49e281104f3be01e8932d58c64690c2e4cf918249678344ea7dad06228c1ed571664549e6339f786142ad4ca14fbc7e8c9138b50164a8b34f9bf74d7d816eb2488689ddad92345bde550e76b6a2330ade69c48dddc1b49e8ddc2b377e34edd44248c79ff9223902b3fbb650baa792831b13e3760bad8b740c70c4d3875767b3b50d0171c5496489c8545351af8ac560973a4d65329d575a135d2a09113cdbba0bc7c87d1620897d57a7cf5730ba566508f57bbd2dbf43c89e6d84fc3177442b2b47f722f3f7b92200ee77e363a433b04871ae1f2affccc4f6fe87a8a54c850e5f637e3e409714952cfd7c0ec337a7d634b7a679da544fdf973bfd43329184fda0ecc74ada27192f2060513bc31461bb197961f5a7ab0b0d0ed7e6585dce915f97f43ef44d39a966846168741c7dad52bb5865b2879d25059a75177b95ba27290cd554442726120e19aa573f01331e36f80134ef61f3e01f21b280bd3cedfa87b470da55d67b0d763e7aff988019ff63a8da090ccbfc093fd4238dc98552cdc5fcd330a9ae86c62000cf2fff9a0e4dacef40ad5b13e757adb8d82486ea54ea8ba65f22f240c40d9783cdb2d6a85c2006f99c93c905df11b7747beaf247aa279d62476b4b066d40351dc0d698359a912e47c2abf27f61046fe573a9208d2a3fa0cd9c79338b76948d5886dee72332ff3c7a3e7f9185bc1f5822f820a44324d0d9e574c509803f63e49f51fa764c0e0b7f11dc81a9031c1ce45990344987cef891344cc76e3574e0bd9e47d142354cd0f7e77cb5ef38a8961b6ef8ab54fb101e41b16780dd979d57bd7ea1f5aea840253fbf37188c2fec67487148df12c6222102c5102239d31005c8a24f0b4703cda0ef5755f313bd59bff7f3db712224aeef70d9fe13ef405b747a8281702f0941c15a672598321e574a05bc080cad80f8b09623792e5afd583325f2b75eeb292d5fb8f57add00b3f5529b73bf05211b9630624fb13c9ceb3ee1d5a32adc95a9da2d42b145bd76f891e14ca5e2946defad5e463b4944714bd3faccb448c558ab429ad6eb0b01abd0e2c0b7da728ff023fefd0b0432bb95b20f29670ff24f515ea999d9cf5121f2b8d3f80252145e3bfd802926b708ff7590cc3e1dd2c183a7edcb8f4112d26bf26e0239d7ac25f0868eba4b306b55baf6864d4db308daf76e8c92f652f957e15b21e77cfef97be528303d4dc62c7681e2a3391b97b8d284922727dd4a7c2715d9e4ee2d04a098a76915952d38d3964a404d56b044595c5f8dafc201aad93fa0ab8c75610effaa0d05e9307ade2fcb79cf68205563a013371dd09f2fa8a76858904edd7764d873748bc923b51429cfc0b37bc17b81067357854b0af9d94c48cdf888f47ec60920e461f877a02a15e1ff6bfdbec1e21bd5e22e6c3d4a4d96d8946868a371b3a4e8cfafad85de31260e0d426fee7a54759d59285c4405e697a80bb174d3c69de2fae4970b8636fc213aac386ff90915c338bc83d69ebe70f9630b7ee6a52c13818bf200d22d6c4cdd8c15e769028f925e8b0d13c97df6b57eeae730b295a570bb297f3a936d7cdbc7ce51619a95cc0c40f3f221363bac5fa2ae2f84fec02d6537fd1c0c612fc9018743955b5ec5abcb4c81dadca5f69d14b5997572f8d3622f3d04b14a9dce13b3025a0d4848d422dfb0e548a5561e702a15384799abcf78d6ac7f25fd3ff1a1e4c8c9923ba044a629b3e3ca88596a030c7a2cd38e0d3bb96f6c87957c343a8bc3c750381e53fd7ef147795ffda3b9c2175fbe240db337c48dea287363272cc37dc6c53391b0abc9746af3c3e8dd0d3ed3bbf31ec137c279ee037ace64be8cb645a7d434e6f056b969c8cf908e7128c8f841eeb1a4da5145af0867969c3134e4e9ba3de45742d161e05c46d49d536d044757df37f6da29ba6a14ee8b2112b6890af82a70a94fdc0cb562fa8acdd42d474c3cf9c11a4582a82e209f2fefb16f626368a213c0513cddf036bba509c7e060ebe3e335f35d88ad57e13d086996f126f86a709ffbc036967afa24634ded84110d0ae3a53f2fb5c32c5b961d78e293e49ca0972afad2b76721a921115d251d3c1e1beea38729cd5946b25b4ce01d86a2e692c46d20d4cd7012cbbc05454e35d55503780bb483b50c6e9b448f493e1e97e1d2c97d8c2e189b74912136540256c56ad62f55726f3810a1e7ef8f8d1c821168938ca69a82a35380616b00097fb865f29e65cccdeb7f1cb29aad2189062152eeea414abf539c336184ea8602c97b727bc25e964cfac48506d92bf6821331ae2a556521a7d5448e3ff77e06d775289d10a2f3dbf58d0679ffa0578186541b196886d93231134ea87b56dd22f68e6fd05bd66410fa658d505f8c28cc7737243d3e6809daaf05ed2b0be2ee50c1e79db695d351a1429175b741a4796ef6ab5a6fe8db6c553fd4fbc214104dc753a49ef3873ac02c19baf02c9f1ec52d827cfe2ec361a139f24cd588a5c89d37f2d6ba9b58801837660446fcad177d06a30351f8d7af00b04498b694bd53d3f9e557ae48ad2a1a63295ba6ef47f3c71e7645a44b8e34785b05c71551d485b267d8f71f8e9b95770ab3c64c12b00806e74433fb7c2d52c68410bb5a60542beaaad532c838a29d0e4f0de7281a2d89f85dbd2f9ce94940f5e056f8b438f00a9d04c38f52055a2d7426596a5f3291aac5d2c5542b6e44f4d7eadc4c367032bf30e602bf1d136b47387e0c8258fda0d2ed79542b63599a99cabb53dbc76dbca650c61fd43b7b951daff0a4d8b0473fea6e0f73886098aeb0540af11e9e2b1a4c2f474313e2a69ce2ac769ac27d19e2b3303d88b306f25c295e807d5688f0634ab3def572edda12a6a7a4877aea2d79e2d0f6cee3fda305d91014079caab1e6d18abae437146ef3bb544fe00a6bd2e053715cdc894c3ae944451545d0b2c898791514438381c2576cd7ff84d3205c142fc292855f9a06115ff2a7df81465ede7c1d4c257a19407fa56e8b07d5c7b90ba8bb33d8e3caba0b7c0a9a7d2682acab4ec04c5003f507cf68a6785f8f096610df8a2a1145a0baa8d6d40ea90cbddf93fcbadf527dba2dfcaab195c64b58e91aefe0b9ec2401fbfdac91e7d198b5ba729b68f042cfadef1be92007a61860de36d89cd2e9517265d0fa3f47d5e956e04eade135749c15813ba29c499807988dcb61dda59b5e3d5b2d6614dd89d97ae860bfd636bbf88362d8b03a58e5faa6e87c9c072b0629b02c421c7146aa64a5e6005833a2ee5c9a9376578a52a57d43fc56603081664e970d4a60108414dbcc8ff32e2ac4f16b7cc375a9606ec0360d41e75d96a79141b24523f8a6ca3c5a6bc624b167b5693ffaf296399758ac267de3665b82b04f8762e0ff8065b323ce6a751cefa2909b872c77d425ef23e62405da90726d3691f44f833c37b3ac4f64e0ddebd347631130c43c402fe197d4e52f7de79ad3ff134df9e770c33ed25120bbbd14f59ab5fca45cb4890bfbafdf09b2e3447ae9162fdfb8e72011d987006a4150d8d3ed50523b66cc93452098a2352be89b0480b689a00a5a76139d7885de87db4d0c47d054a871a89255e4115fe2c72bbb5e392a522f422dfc937b9e34bd68638edd5226ff41955539e21d261f5abbd5d06e67b72b4ef54953ca627b7143986e3885a783a558f523efe6d6ab5691e5bf33236ba378086dc8fcd439edc55936608cab2c9c1a8f2bc4fbdb9d2e452677d5a8f5a836a966d2f0cba64d9ef556e864c4e10666f763e666ac43d045bd8fa14ad88e3c7f19d7c215bc293b2504a8ecae43b596a0ca13b696f00427487f6fc1050dbe65ccb2bb46e58c42c7c1291b43fdf9f4d709792c9e699cef4e46a818d9b765c0396399c75e6820939678c661a66e2214b7492a14e7784fd68a391609c0623062fe0e95f2f61fa36743c9a56014cfd555e3d33443cdf70527b953b3eec792cb2db623f466a46f45344dc5ba15ad49b7144e7bfa000e6e072cab21a6959baf3c1ba03b7871b7665f7929e31f663afa83c193dc4340c020fbf003fa8309c163d0162b32e1d2a41299f4c46084c17a566f095a179c0b6b3689273d2fe86c31a2fc93d632b5daab6dd16d224792eb1c882deca88693440a595845f8e31c49433ec4f5627cb59e6130c6ccd7f5118a1f9478f3433dea869b37bf1c980b5b01ead3fbea5d27f28c68ea9f96de6392eb25f5b66573df0cbdaddd1f13ab73e796feaa497cb52680ec1d8df9f2926205129df6a70860c4fac63f328e0fc78c9cdc3c46d08f5b593d699813b00372c99df6e7bc3577c60f3f6a2f463f850f18bec4edfc5ab944f7212e3b4eca340a0a746fabdc9855d3b2d8511b2d7b40d41ccf7d08e1b4903a7e5bb2e73e7fe0a3ab8bf7f66473197c0276ef3e4aab7011dc283b5ed60f04782d7c5dab3644896899d90ae51e6027f68fdb537b46788e1624435bfd35a4a833bc36ee2957d9f4c561dd40dfc0704ebad5745b2fe55fee9331924ec0ece685a3c3d5888d6e23bac16a26a4b78bb46c7907c5aac25117ad683e87073942c7e496bb36485f981bf90a5d648162777f287677a71e4154c63cc5139a1ab0defb6eac1d45dfae79836ca2a0cac00bc39b5fe3bc8a7742c9d1ca385ff1b66d6674e3877a9cbcdbfb6bc934cc25897a7ffc6730257cf4008827d74bf2396efbe57aab4488ba865"}, {0x40, 0x117, 0x8000, "e13cf97c82e088ab2235e2711acc1c96d7a36b94bc101b99a7e75db2b067be95483332b37050a19b9b55c6a2"}, {0x30, 0x114, 0xfffffffffffffffa, "f49b74c3cfb342be2e7ac714a44a06dfded1c7890ada03c264beae68fc2c07"}], 0x1080}, 0x14}, {{&(0x7f0000002780)=@alg={0x26, 'aead\x00', 0x0, 0x0, 'seqiv(gcm(khazad))\x00'}, 0x80, &(0x7f0000002bc0)=[{&(0x7f0000002800)="00bdc208a33472bb18f6e89d1a2a7dd4944ae8a61e70495a9895e37b55473f8188791ef9f5aea69cd6c45ec1dfd0ff15da84c21fc32c6a18ed8cf4918e2b996346f0b455b3c42527c22c1e87457feb692decb93f53f51503906cf7c5fbefa0e0ec0b90dcca94afba81986a9bf49da015ae659c811620137f49b17f3d48fce105d766a599f22a1d5eea02ef64adedd5", 0x8f}, {&(0x7f00000028c0)="aee8a413668637ecf446b3dcf22ad0c54a65843aa315d81bab06a8fc4b154ce1a1d96b433b", 0x25}, {&(0x7f0000002900)="b889e5676babcbbba51c516ce2b46db3a87c3b7b09d18afae9d80577c24b33e66b108088c2a2955ed70ea18daac890ee47808518c247d35f60fe9243bf1ad3e115ed3134d42d24a4484616fd0a373bc112820a263fddd73255823011275666cff7055f9de06a3585926b7ee34afdbfe02b6c19e5f6", 0x75}, {&(0x7f0000002980)="f986f7abe65a035ea6c005148fd3702408fde3310eff958dd84aaf6238956b4bdb61acf877237cc11551a16a6bfa389646f57cab7eebe5cc180e67663a199c33d321582440d4ccfc6fed84651134412caf08357ba50c00084124139113087dc9ed0c14640f32aa4ece419e4e98e3e4010f70bd020e4d1e6db61e535fdcae6486c4852e2cafcfb2f5bf30", 0x8a}, {&(0x7f0000002a40)="227c9a1919833610fa4d5008044b3dfe13ab922ea77321adeb37eb28689fd16bc82834af3163aeddbd04c35bce93c0b4f121a87a03efdd86274b7176f2a2bbfa3362a07cf7d535ae54d7e4fdaf95199286dd8b62dd8f4930bea88b62ae1d60ece14a", 0x62}, {&(0x7f0000002ac0)="a287e1157285c3937a226d93acf3b40d32928895049ebefd34a2f0d0942befb7355fa71362afc3e3c4a41de9180f564ad9a885d107ddde3f0a26f239532d537e961fb48f19645e2f7c1e3e0045213c6565c6061680c8476d56a7e8c392bb2cc9d0ffc017982abd4ebd837aecb9034c72349f939399f49acf50adf55af9321ea1d0398cd15fc8d514c089b8c6cf9e406265d2069eba1632b20ef340c9baf5628e1adde630671d91b4cea6d91188191c303996b559accc8d51012c43d579502b21d1908098ed2650d55575c7b6edd61d5444ca3414aaf9", 0xd6}], 0x6, 0x0, 0x0, 0x8000}, 0x101}, {{&(0x7f0000002c40)=@in={0x2, 0x4e20, @rand_addr=0x80}, 0x80, &(0x7f0000002d80)=[{&(0x7f0000002cc0)="6de21600c45e4182a7b44a71fd9e7251089d2a273176dc33264a4e65d214fcdd96431b3dc502f18302559add5b19844b1f4415f6e9c330f52981fbf57a7af4789df51899d2428d60566c48e4e0c1931a5fe9654904c96ca9b08490be761a5e116abecd5c887385d78cba49b0c3c5f7ac3560534c38504d8c412474b65ac4753febc3624c57ea10c10130a4429f2920", 0x8f}], 0x1, &(0x7f0000002dc0)=[{0xa8, 0x117, 0x2, "741a767e2c83f05c1693bc0de4beec6ad2249a19490ddcfc8e17bbb35ab1b32cd60b1519dfdb1b3d372151abdfa3b562edf0a1e31535c09e675c4086e1c32ae6bc67ee24ee59acb7fd46db575218528161185d6e87344f0c7bf13c2aed62a65401277ee351114de22e1cfc1e4b0c1993d194b920151470f0702a1bd6f75d35899ab9a86f95ef59ab8b658af82c23d7d757ac29"}], 0xa8, 0x40000}, 0x9}], 0x9, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:00:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) 12:00:52 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) 12:00:52 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="786673ff", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:00:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x500000000000000]}}, 0x1c) 12:00:52 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x122, 0x400000000000) [ 440.356309] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 440.374479] binder: 17611:17617 ioctl c0306201 200001c0 returned -14 [ 440.393752] binder_alloc: binder_alloc_mmap_handler: 17611 20001000-20004000 already mapped failed -16 12:00:52 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000000)=ANY=[@ANYBLOB="000004000000000000c1ff102a4b63acecffb7aa49505ff12731fbab1fbbc7"], 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:00:52 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1ad, 0x400000000000) 12:00:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xffffff91]}}, 0x1c) [ 440.430227] binder: BINDER_SET_CONTEXT_MGR already set [ 440.436498] binder: 17611:17617 ioctl 40046207 0 returned -16 [ 440.442726] binder_alloc: 17611: binder_alloc_buf, no vma [ 440.454862] binder: 17611:17628 ioctl c0306201 200001c0 returned -14 12:00:52 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000]}) [ 440.494412] binder: release 17611:17617 transaction 767 out, still active [ 440.506496] binder: undelivered TRANSACTION_COMPLETE 12:00:52 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:00:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x7a00, &(0x7f0000000480)="bce854e9"}) [ 440.584864] binder_release_work: 12 callbacks suppressed [ 440.584872] binder: undelivered TRANSACTION_ERROR: 29189 12:00:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x5400000000000000]}}, 0x1c) [ 440.644968] binder: send failed reply for transaction 767, target dead 12:00:52 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1d0, 0x400000000000) 12:00:52 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) [ 440.731670] binder_alloc: binder_alloc_mmap_handler: 17652 20001000-20004000 already mapped failed -16 [ 440.763493] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 440.778433] binder: BINDER_SET_CONTEXT_MGR already set [ 440.783737] binder: 17652:17653 ioctl 40046207 0 returned -16 12:00:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xf401000000000000]}}, 0x1c) 12:00:52 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f]}) [ 440.886212] XFS (loop3): Invalid superblock magic number [ 440.915171] binder: send failed reply for transaction 772 to 17652:17653 [ 440.922133] binder: undelivered TRANSACTION_COMPLETE 12:00:52 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x12c, 0x400000000000) 12:00:52 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x280880, 0x30) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000380)=0x0) ptrace$getsig(0x4202, r2, 0x8151, &(0x7f00000000c0)) r3 = geteuid() getresgid(&(0x7f00000003c0)=0x0, &(0x7f0000000400), &(0x7f0000000440)) r5 = getpgrp(0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000480)={{{@in=@local, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@remote}}, &(0x7f0000000580)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, 0x0}, &(0x7f0000000600)=0xc) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000640)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000680)={{{@in=@rand_addr, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@rand_addr}}, &(0x7f0000000780)=0xe8) stat(&(0x7f00000007c0)='./file0\x00', &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000008c0)={0x0, 0xffffffffffffff9c, 0x0, 0x2, &(0x7f0000000880)='&\x00', 0xffffffffffffffff}, 0x30) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000900)={{{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@loopback}}, &(0x7f0000000a00)=0xe8) r13 = getegid() sendmmsg$unix(r1, &(0x7f0000000e00)=[{&(0x7f0000000040)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000000340)=[{&(0x7f0000000140)="24c2978ef9532aea4dd6776df2a49795bc2dc811997bf98214fb3fb5b2407b42010c9f972958e7ba74724adeea24c99993cb941e89aa55f03f723caafcbc404ed86f2ef2bd082d7a12b322f3bbd02877ddb5294af75facae5df1d268b3132651ae50ee456e0a0b1a111ec9c3e6b6f525", 0x70}, {&(0x7f00000000c0)}, {&(0x7f0000000200)="5593d4a4b8e5202295e563ea8dc01c92fcab568f4a5bda700f1e364cdd2fc8e0a9552d40cdd1e16657afef56e553b96ac584277f479c031b2cb0d0583f4fdd94271184ed12e1ccd43d33d309613375a48858b31714d95594f3a37ac707823f", 0x5f}, {&(0x7f0000000280)="de86d0c63766c022a63ce1b969907f9da8ebca1383fabf60ed074ec2a5bf3f6cff96bf35112e3c493ac2c4cf51d355bfb8eaa8c165e8159274ee2f403f7de4e861683588d8b071f31e30b2a09e54c5a946d9f2ebea1394c87a525a2cd94dcd9e1438e78acaad8716f07edc5620b94e98906893aee946efc9913914038788a275d81b46970d324e55fbcd1240ddb46d906c495ba58d4e2d6f5e8b4c7d5c2abd66ccc54ba0cffccfd500d8a0d187500a35378a06a5d6c106ab1b", 0xb9}], 0x4, &(0x7f0000000a40)=[@cred={0x20, 0x1, 0x2, r2, r3, r4}, @cred={0x20, 0x1, 0x2, r5, r6, r7}, @rights={0x38, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0, r0, r0]}, @rights={0x38, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r8, r9, r10}, @cred={0x20, 0x1, 0x2, r11, r12, r13}, @rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0]}], 0x118, 0x1}, {&(0x7f0000000b80)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000d00)=[{&(0x7f0000000c00)="4c4f89383ba4c70b82c4dfacbbd737828babfe0ee609902f7cfe2376d544e431d816a435c4989662a195f7297cdc414aa8733403621610de1a491746fd4bd72a90927431d7ec3f72b3a12cfc3a225294ed40e875421090822fd284d16a5111a6d1b091baffb9a6bce15b8439cdc16d8717d583a1070b6c583dd5041564593cd00f00447b1fa21c3ad570033b73911f213baa87408ec90f59e736e2a1b705e0eb1fe9eb7ae07ef5ca28ca88488fd6b6fad8c832c3859a7810f1ca1d0559958f3ce5771b8d327d85ac2ec44645db8f4b67dd8c1040beeee038e7c50c027d04fb4983b922c1a254b504e0340a7457afbc", 0xef}], 0x1, &(0x7f0000000d40)=[@rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0]}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}, @rights={0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0]}, @rights={0x20, 0x1, 0x1, [r0, r0, r0, r0]}], 0x98, 0x8000}], 0x2, 0x0) 12:00:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x6c00, &(0x7f0000000480)="bce854e9"}) [ 440.942665] binder: undelivered TRANSACTION_ERROR: 29189 [ 440.951004] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:00:53 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) [ 441.070508] binder_alloc: binder_alloc_mmap_handler: 17697 20001000-20004000 already mapped failed -16 12:00:53 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xf4010000]}}, 0x1c) 12:00:53 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667304", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 441.114594] binder: BINDER_SET_CONTEXT_MGR already set [ 441.130753] binder: release 17697:17698 transaction 776 out, still active [ 441.137913] binder_alloc: 17697: binder_alloc_buf, no vma [ 441.143562] binder: undelivered TRANSACTION_COMPLETE [ 441.149853] binder: 17697:17698 ioctl 40046207 0 returned -16 12:00:53 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xa6, 0x400000000000) [ 441.178479] binder: send failed reply for transaction 776, target dead 12:00:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x48, &(0x7f0000000480)="bce854e9"}) [ 441.260013] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:00:53 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x577390f870]}}, 0x1c) 12:00:53 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x72, 0x400000000000) 12:00:53 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f]}) [ 441.316053] binder: undelivered TRANSACTION_ERROR: 29189 [ 441.349356] binder_transaction: 29 callbacks suppressed [ 441.349373] binder: 17725:17726 transaction failed 29201/-71, size 0-0 line 2741 [ 441.390427] binder_alloc: binder_alloc_mmap_handler: 17725 20001000-20004000 already mapped failed -16 [ 441.464817] binder: BINDER_SET_CONTEXT_MGR already set [ 441.477087] binder: 17725:17726 ioctl 40046207 0 returned -16 12:00:53 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x80fe]}}, 0x1c) 12:00:53 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:00:53 executing program 0: r0 = inotify_init1(0x80800) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000000)={0x7, 0x80000001, 0x2, 0x5, 0x3, [{0x3ad6, 0xfffffffffffffffb, 0x5, 0x0, 0x0, 0x20c}, {0x1f, 0xe252, 0x54fc, 0x0, 0x0, 0x2802}, {0x5, 0xffffffffffffd9ac, 0xb473, 0x0, 0x0, 0x100}]}) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x10000, 0x0, @empty, 0x4}, 0xd) setsockopt$inet6_opts(r1, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r1, &(0x7f0000000000), 0x0, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x2c, &(0x7f0000000040), 0x0) 12:00:53 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x112, 0x400000000000) [ 441.508868] binder_alloc: 17725: binder_alloc_buf, no vma [ 441.527331] binder: 17725:17746 transaction failed 29201/-71, size 0-0 line 2741 [ 441.539599] binder: 17725:17729 transaction failed 29189/-3, size 0-0 line 2973 [ 441.547854] binder: release 17725:17726 transaction 781 out, still active 12:00:53 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) [ 441.556486] binder: undelivered TRANSACTION_COMPLETE 12:00:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x6, &(0x7f0000000480)="bce854e9"}) [ 441.595081] binder: undelivered TRANSACTION_ERROR: 29189 [ 441.664719] binder: send failed reply for transaction 781, target dead 12:00:53 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x1600000000000000]}}, 0x1c) 12:00:53 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000]}) 12:00:53 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x4, 0x1) ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f0000000080)={&(0x7f0000000040)=[0x80, 0x10000, 0x53c1, 0xbb68, 0x12fe, 0xff, 0x0, 0xff], 0x8, 0x6, 0x2, 0x8, 0x6, 0xffffffff80000001, {0x8, 0x5, 0x2, 0x24bb, 0xdffa, 0x8, 0xfffffffffffffffb, 0x2, 0x4, 0xc24, 0x7, 0x2, 0x7, 0x7, "e5d7c51c1b0179a9f38b7849ae3268a39bde126c9d05b58fc961a91cf9b3b3b5"}}) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) getsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000140)={0x0, 0x80}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000200)={r2, 0x82, "6767a870ca533e2cc48683745ff3fc664d0ac694bf90d0c8723a55395ffd7a9dc2f8565d1ed290dc6b94a82725ff3c590a47354d77bae77b6fe230a397f300b3404146d6a0efd7eb9b2ab05bc880f33c34ec5cc5c64a0a680d73d1d63137ad471b0c1623d905cec0a67700f649f5152c672735eac8dfe918e88dd630f712bf116dfa"}, &(0x7f00000002c0)=0x8a) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:00:53 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x11f, 0x400000000000) [ 441.773967] binder: 17766:17770 transaction failed 29201/-71, size 0-0 line 2741 [ 441.835407] XFS (loop3): Invalid superblock magic number [ 441.861298] binder_alloc: binder_alloc_mmap_handler: 17766 20001000-20004000 already mapped failed -16 [ 441.885568] binder_alloc: 17766: binder_alloc_buf, no vma [ 441.891737] binder: 17766:17789 transaction failed 29189/-3, size 0-0 line 2973 [ 441.900509] binder: BINDER_SET_CONTEXT_MGR already set [ 441.903154] binder: 17766:17793 transaction failed 29201/-71, size 0-0 line 2741 [ 441.921463] binder: 17766:17770 ioctl 40046207 0 returned -16 12:00:53 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) 12:00:53 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x11, 0x400000000000) [ 441.954840] binder: release 17766:17770 transaction 786 out, still active [ 441.961858] binder: undelivered TRANSACTION_COMPLETE 12:00:53 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x5000000]}}, 0x1c) [ 442.004823] binder: undelivered TRANSACTION_ERROR: 29189 12:00:54 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:00:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x100000000000000, &(0x7f0000000480)="bce854e9"}) [ 442.053128] binder: send failed reply for transaction 786, target dead 12:00:54 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) [ 442.108159] net_ratelimit: 1 callbacks suppressed [ 442.108171] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:00:54 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x8a, 0x400000000000) [ 442.192464] binder: 17816:17817 transaction failed 29201/-71, size 0-0 line 2741 [ 442.242349] binder: 17816:17817 ioctl c0306201 200001c0 returned -14 [ 442.284027] binder: BINDER_SET_CONTEXT_MGR already set 12:00:54 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x400000000000000]}}, 0x1c) 12:00:54 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) [ 442.306108] binder: 17816:17835 transaction failed 29201/-71, size 0-0 line 2741 [ 442.306163] binder_alloc: 17816: binder_alloc_buf, no vma [ 442.322672] binder: 17816:17817 ioctl 40046207 0 returned -16 [ 442.335874] binder: 17816:17831 transaction failed 29189/-3, size 0-0 line 2973 12:00:54 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x83, 0x400000000000) [ 442.374135] binder: release 17816:17817 transaction 791 out, still active [ 442.376113] XFS (loop3): Invalid superblock magic number [ 442.386811] binder: undelivered TRANSACTION_ERROR: 29189 [ 442.400093] binder: 17816:17835 ioctl c0306201 200001c0 returned -14 [ 442.439966] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 442.441369] binder: send failed reply for transaction 791, target dead 12:00:54 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000200)='/dev/dsp#\x00', 0x24, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000240)=0x1d, 0x4) 12:00:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x48000000, &(0x7f0000000480)="bce854e9"}) 12:00:54 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f]}) 12:00:54 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:00:54 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1a4, 0x400000000000) 12:00:54 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x20000000]}}, 0x1c) [ 442.697284] binder_transaction: 16 callbacks suppressed [ 442.697295] binder: 17869:17873 got reply transaction with no transaction stack [ 442.725245] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:00:54 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) [ 442.757535] binder: 17869:17873 transaction failed 29201/-71, size 0-0 line 2741 [ 442.790117] binder: 17869:17873 ioctl c0306201 200001c0 returned -14 12:00:54 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x40020000]}}, 0x1c) 12:00:54 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x130, 0x400000000000) [ 442.816808] XFS (loop3): Invalid superblock magic number [ 442.853265] binder: BINDER_SET_CONTEXT_MGR already set [ 442.892726] binder: 17869:17902 got reply transaction with no transaction stack [ 442.912978] binder_alloc: 17869: binder_alloc_buf, no vma [ 442.924999] binder: 17869:17873 ioctl 40046207 0 returned -16 12:00:54 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:00:54 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) [ 442.946597] binder: 17869:17902 ioctl c0306201 200001c0 returned -14 12:00:54 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1b0, 0x400000000000) [ 443.012228] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 443.038324] binder: undelivered TRANSACTION_ERROR: 29189 [ 443.186191] XFS (loop3): Invalid superblock magic number 12:00:55 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) exit(0x2) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) accept$inet6(r0, &(0x7f0000000000), &(0x7f0000000040)=0x1c) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x121000, 0x0) openat$cgroup_int(r1, &(0x7f00000000c0)='cpuset.memory_spread_page\x00', 0x2, 0x0) 12:00:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x6c000000, &(0x7f0000000480)="bce854e9"}) 12:00:55 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x2]}}, 0x1c) 12:00:55 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000]}) 12:00:55 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xbc, 0x400000000000) 12:00:55 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:00:55 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x3e8]}}, 0x1c) [ 443.365893] binder: 17945:17946 got reply transaction with no transaction stack [ 443.379900] binder: 17945:17946 ioctl c0306201 200001c0 returned -14 [ 443.389504] binder: BINDER_SET_CONTEXT_MGR already set [ 443.405884] binder: 17945:17958 got reply transaction with no transaction stack [ 443.424069] binder_alloc: 17945: binder_alloc_buf, no vma [ 443.434701] binder: 17945:17946 ioctl 40046207 0 returned -16 [ 443.463117] binder_thread_release: 1 callbacks suppressed 12:00:55 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) 12:00:55 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1b, 0x400000000000) [ 443.463129] binder: release 17945:17946 transaction 801 out, still active [ 443.477000] binder: 17945:17958 ioctl c0306201 200001c0 returned -14 [ 443.515856] binder: undelivered TRANSACTION_ERROR: 29189 12:00:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0xa00, &(0x7f0000000480)="bce854e9"}) [ 443.564724] binder_send_failed_reply: 1 callbacks suppressed [ 443.564731] binder: send failed reply for transaction 801, target dead 12:00:55 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x800000000000000]}}, 0x1c) 12:00:55 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1f8, 0x400000000000) [ 443.649438] binder: 17987:17988 got reply transaction with no transaction stack [ 443.661529] XFS (loop3): Invalid superblock magic number [ 443.683416] binder_alloc_mmap_handler: 3 callbacks suppressed [ 443.683432] binder_alloc: binder_alloc_mmap_handler: 17987 20001000-20004000 already mapped failed -16 [ 443.689829] binder: BINDER_SET_CONTEXT_MGR already set [ 443.729299] binder: 17987:17996 got reply transaction with no transaction stack [ 443.741839] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 443.764748] binder_alloc: 17987: binder_alloc_buf, no vma [ 443.771661] binder: 17987:17988 ioctl 40046207 0 returned -16 [ 443.803102] binder: release 17987:17988 transaction 806 out, still active [ 443.817972] binder_release_work: 3 callbacks suppressed [ 443.817978] binder: undelivered TRANSACTION_COMPLETE [ 443.904637] binder: undelivered TRANSACTION_ERROR: 29189 [ 443.944714] binder: send failed reply for transaction 806, target dead 12:00:56 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000000)=ANY=[@ANYBLOB="00000400000000e324755dc0"], 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:00:56 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f]}) 12:00:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x4c00000000000000, &(0x7f0000000480)="bce854e9"}) 12:00:56 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:00:56 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x115, 0x400000000000) 12:00:56 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xb8ff0000]}}, 0x1c) [ 444.336180] binder: 18016:18020 got reply transaction with no transaction stack [ 444.355305] binder: 18016:18020 ioctl c0306201 200001c0 returned -14 [ 444.366053] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:00:56 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x184, 0x400000000000) [ 444.401319] binder_alloc: binder_alloc_mmap_handler: 18016 20001000-20004000 already mapped failed -16 [ 444.425153] binder: BINDER_SET_CONTEXT_MGR already set [ 444.443717] binder: 18016:18039 got reply transaction with no transaction stack 12:00:56 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x1100]}}, 0x1c) 12:00:56 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) [ 444.455857] binder_alloc: 18016: binder_alloc_buf, no vma [ 444.483221] binder: 18016:18020 ioctl 40046207 0 returned -16 [ 444.511787] binder: release 18016:18020 transaction 811 out, still active [ 444.523275] binder: 18016:18039 ioctl c0306201 200001c0 returned -14 [ 444.530178] binder: undelivered TRANSACTION_COMPLETE [ 444.538561] XFS (loop3): Invalid superblock magic number [ 444.539859] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:00:56 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xff00000000000000]}}, 0x1c) 12:00:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x74000000, &(0x7f0000000480)="bce854e9"}) [ 444.595326] binder: undelivered TRANSACTION_ERROR: 29189 [ 444.629131] binder: send failed reply for transaction 811, target dead 12:00:56 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) [ 444.723489] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 444.740623] binder: 18064:18068 got reply transaction with no transaction stack [ 444.772512] binder: 18064:18068 ioctl c0306201 200001c0 returned -14 [ 444.814853] binder_alloc: binder_alloc_mmap_handler: 18064 20001000-20004000 already mapped failed -16 [ 444.825647] binder: BINDER_SET_CONTEXT_MGR already set [ 444.831710] binder_alloc: 18064: binder_alloc_buf, no vma [ 444.850061] binder: 18064:18068 ioctl 40046207 0 returned -16 12:00:56 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffff9c, 0x84, 0x76, &(0x7f0000000080)={0x0, 0x7}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000200)={r1, @in6={{0xa, 0x4e23, 0x100, @local, 0xff}}}, &(0x7f0000000140)=0x84) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000180)=0xffff, 0x4) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x8) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:00:56 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:00:56 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xff0f000000000000]}}, 0x1c) 12:00:56 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000]}) 12:00:56 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1f3, 0x400000000000) 12:00:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x7a000000, &(0x7f0000000480)="bce854e9"}) [ 444.865412] binder: 18064:18076 got reply transaction with no transaction stack [ 444.873178] binder: 18064:18076 ioctl c0306201 200001c0 returned -14 [ 444.880907] binder: release 18064:18068 transaction 816 out, still active [ 444.896806] binder: undelivered TRANSACTION_COMPLETE [ 444.975149] binder: send failed reply for transaction 816, target dead [ 445.022516] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 445.039523] binder: 18092:18099 ioctl c0306201 200001c0 returned -14 12:00:57 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) 12:00:57 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xa00]}}, 0x1c) [ 445.079906] binder_alloc: binder_alloc_mmap_handler: 18092 20001000-20004000 already mapped failed -16 [ 445.100591] XFS (loop3): Invalid superblock magic number [ 445.118115] binder: BINDER_SET_CONTEXT_MGR already set 12:00:57 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x119, 0x400000000000) [ 445.142662] binder_alloc: 18092: binder_alloc_buf, no vma [ 445.142909] binder: 18092:18112 ioctl c0306201 200001c0 returned -14 [ 445.195587] binder: release 18092:18099 transaction 821 out, still active [ 445.202675] binder: undelivered TRANSACTION_COMPLETE [ 445.208996] binder: 18092:18099 ioctl 40046207 0 returned -16 12:00:57 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000]}) 12:00:57 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="786673ff", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 445.262130] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 445.274947] binder: send failed reply for transaction 821, target dead 12:00:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x5000000, &(0x7f0000000480)="bce854e9"}) [ 445.437768] binder: 18139:18141 ioctl c0306201 200001c0 returned -14 [ 445.463642] binder_alloc: binder_alloc_mmap_handler: 18139 20001000-20004000 already mapped failed -16 [ 445.482044] binder: BINDER_SET_CONTEXT_MGR already set [ 445.488347] binder: 18139:18147 ioctl c0306201 200001c0 returned -14 [ 445.495980] binder: 18139:18141 ioctl 40046207 0 returned -16 [ 445.502508] binder: release 18139:18141 transaction 826 out, still active [ 445.510803] binder: undelivered TRANSACTION_COMPLETE [ 445.511553] binder_alloc: 18139: binder_alloc_buf, no vma [ 445.595115] binder: send failed reply for transaction 826, target dead 12:00:57 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000200)=ANY=[@ANYBLOB="0000040000009334e19375832004000000a580808a2cfcea23463b22f784c37a6ffbdea3b2332787bd0be761f2ff4c4c20a103e5d0ac3a0de30029eabd26d3bbbc622b66ca224673d5895898efb5c9891d36ca950a8bcd6a37ccff49b20a977e2e66ec9c13dbcec6bb4f487047cb3b4d7dc5a62e3e9db0d2058797a6c5960e196af501a85acbdfde5d896b248c390be33d26da01f543da9822801fe6730d58fb070a09175eccf33e"], 0x8) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x121000, 0x0) r2 = semget(0x1, 0x0, 0x58) semctl$SEM_STAT(r2, 0x3, 0x12, &(0x7f0000000140)=""/169) recvmsg$kcm(r1, &(0x7f0000000ac0)={&(0x7f00000002c0)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000000940)=[{&(0x7f0000000340)=""/88, 0x58}, {&(0x7f00000003c0)=""/103, 0x67}, {&(0x7f0000000440)=""/207, 0xcf}, {&(0x7f0000000540)=""/171, 0xab}, {&(0x7f0000000000)=""/23, 0x17}, {&(0x7f0000000600)=""/82, 0x52}, {&(0x7f0000000680)=""/253, 0xfd}, {&(0x7f0000000780)=""/172, 0xac}, {&(0x7f0000000840)=""/239, 0xef}, {&(0x7f00000000c0)=""/14, 0xe}], 0xa, &(0x7f0000000a00)=""/133, 0x85, 0x7}, 0x22) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000b00)={@remote, r3}, 0x14) write$P9_RWRITE(r1, &(0x7f0000000080)={0xb, 0x77, 0x1, 0x1}, 0xb) ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0x401) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:00:57 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x4000]}}, 0x1c) 12:00:57 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x51, 0x400000000000) 12:00:57 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) 12:00:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x4, &(0x7f0000000480)="bce854e9"}) 12:00:57 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667392", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 445.723004] binder_alloc: binder_alloc_mmap_handler: 18156 20001000-20004000 already mapped failed -16 [ 445.767195] binder: BINDER_SET_CONTEXT_MGR already set 12:00:57 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x1802]}}, 0x1c) 12:00:57 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f]}) 12:00:57 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x5d, 0x400000000000) [ 445.797672] binder: 18156:18163 ioctl 40046207 0 returned -16 [ 445.881182] binder_release_work: 3 callbacks suppressed [ 445.881189] binder: undelivered TRANSACTION_ERROR: 29201 12:00:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x6c, &(0x7f0000000480)="bce854e9"}) 12:00:57 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:00:57 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) [ 445.984846] binder: undelivered TRANSACTION_ERROR: 29201 [ 445.990431] binder: send failed reply for transaction 831 to 18156:18163 [ 446.023211] binder: undelivered TRANSACTION_COMPLETE [ 446.037528] binder: undelivered TRANSACTION_ERROR: 29189 [ 446.100150] binder_alloc: binder_alloc_mmap_handler: 18198 20001000-20004000 already mapped failed -16 [ 446.146166] binder: BINDER_SET_CONTEXT_MGR already set [ 446.169637] binder: 18198:18199 ioctl 40046207 0 returned -16 [ 446.192659] binder: release 18198:18199 transaction 835 out, still active [ 446.202863] binder: undelivered TRANSACTION_COMPLETE 12:00:58 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) r1 = accept(r0, 0x0, &(0x7f0000001680)) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r1, 0x800442d2, &(0x7f0000001740)={0x3, &(0x7f00000016c0)=[{0x0, 0x0, 0x0, @dev}, {0x0, 0x0, 0x0, @broadcast}, {0x0, 0x0, 0x0, @random}]}) setsockopt$inet6_int(r0, 0x29, 0x4e, &(0x7f0000000000)=0x5, 0x4) 12:00:58 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x182, 0x400000000000) 12:00:58 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x20000]}}, 0x1c) 12:00:58 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) 12:00:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x7400000000000000, &(0x7f0000000480)="bce854e9"}) [ 446.220743] XFS (loop3): Invalid superblock magic number [ 446.285014] binder: send failed reply for transaction 835, target dead 12:00:58 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x2000000]}}, 0x1c) 12:00:58 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 446.351667] binder: 18227:18237 ioctl c0306201 200001c0 returned -14 12:00:58 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xf, 0x400000000000) 12:00:58 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f]}) [ 446.414946] binder_alloc: binder_alloc_mmap_handler: 18227 20001000-20004000 already mapped failed -16 [ 446.432071] binder: BINDER_SET_CONTEXT_MGR already set [ 446.488595] binder: 18227:18237 ioctl 40046207 0 returned -16 [ 446.520068] binder_alloc: 18227: binder_alloc_buf, no vma [ 446.546902] binder_transaction: 25 callbacks suppressed [ 446.546920] binder: 18227:18250 transaction failed 29201/-71, size 0-0 line 2741 [ 446.554631] binder: 18227:18240 transaction failed 29189/-3, size 0-0 line 2973 12:00:58 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x179, 0x400000000000) 12:00:58 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x8b376316]}}, 0x1c) [ 446.597425] binder: 18227:18250 ioctl c0306201 200001c0 returned -14 [ 446.611612] binder: release 18227:18237 transaction 839 out, still active [ 446.623272] binder: undelivered TRANSACTION_COMPLETE [ 446.650952] XFS (loop3): Invalid superblock magic number [ 446.665178] binder: undelivered TRANSACTION_ERROR: 29189 12:00:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x4300000000000000, &(0x7f0000000480)="bce854e9"}) [ 446.705459] binder: send failed reply for transaction 839, target dead [ 446.787068] binder: 18282:18287 transaction failed 29201/-71, size 0-0 line 2741 [ 446.800823] binder: 18282:18287 ioctl c0306201 200001c0 returned -14 [ 446.832558] binder_alloc: binder_alloc_mmap_handler: 18282 20001000-20004000 already mapped failed -16 [ 446.871774] binder: BINDER_SET_CONTEXT_MGR already set [ 446.884168] binder: 18282:18287 ioctl 40046207 0 returned -16 [ 446.891008] binder_alloc: 18282: binder_alloc_buf, no vma [ 446.891814] binder: 18282:18293 transaction failed 29201/-71, size 0-0 line 2741 [ 446.896857] binder: 18282:18291 transaction failed 29189/-3, size 0-0 line 2973 [ 446.912326] binder: 18282:18293 ioctl c0306201 200001c0 returned -14 [ 446.930755] binder: release 18282:18287 transaction 844 out, still active [ 446.938720] binder: undelivered TRANSACTION_COMPLETE 12:00:59 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0xffffffffffffff59) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x400, 0x0) sendmsg$kcm(r1, &(0x7f00000008c0)={&(0x7f0000000040)=@l2={0x1f, 0x6, {0x7f, 0x0, 0x9, 0xff, 0x200, 0x4}, 0x100000001, 0xdfa}, 0x80, &(0x7f0000000400)=[{&(0x7f00000000c0)="a581faccdd8054be229ede40851c8f4f7769a9c5e20e8957ea3a4b", 0x1b}, {&(0x7f0000000200)="3f2b867eb61a815f7cf18cb91b32c042819fbad1254c9fd0c78267a7c7dd11532a69501324189cdf0240e713ab8c2423eff5448224b5c208700f9e622899e98060b46da57756e313aa702a30aa3d174a6aa3e4136e9f130b6bc6fc2e8bc54764db9bc112b2cc495a7d75274af3545ff3ef41b34426189c123f35cad1413779c9f1c89877ec98", 0x86}, {&(0x7f0000000140)="add020f073c366984610ee425f7ddb743dceabbd9ef78493f2a268bc58daae3fb3d93b257c7e21bbe5c93aee94692569c7c65c75d9f3085482e0075ab2de3d86fd491c9142061ee10a2d1d0af236973cd2eb04", 0x53}, {&(0x7f00000002c0)="0bc5059657963d3b418bf92176a2d78e23d7d9d6f4ca6a13a8bba23ce7388f7931325f9b25004f8b781da3c1", 0x2c}, {&(0x7f0000000300)="75b6661e8810e9dba6ba6a602eb3941d28031c1ac13bf00cbfad28c38a71b0df3bdd4669aa65efcbc9f937b921a5bfdde180eec2cd1672496a1700f00406f2a9833a5b3f052ade91c33cf4ccd7182f7a8d3cf6e734fcd1abf113dd696978da39bc3634d2aafa1aae52ffbe44ebdaaf0e69d4c29f12438da29d5f6f37dab7c5f20111c6d4df697e8e0337691b7bbdc5d0a21b098e6635ee16f750b8be9b8f408670e1d263f4f365c183abf955c3c76d65c805678f942bd34953f9f9914e4a68a80fd9ba8fadf6e5ebcb9452f8204d99c2de8fa74296572d8fd9186bcb0f0970b27e3489e785cc3bc0b974abcb40fb42906bec2f", 0xf3}], 0x5, &(0x7f00000009c0)=ANY=[@ANYBLOB="2000000000000000000000000700000093aaee2e39906446170100000000000010010000000000003b01000001000000d0e357ca4eef8739f181d41514c262a8b0b5c427ff3aa03879c5ecf9e74ef9ebeaa431cd4b1eb75957ffe545fa70d0662b76dc5458f46eea2b4f21de2fc265e2bdbb455ff13f2e8186f24befbc0fdbb0b95a48707cb99644113155ec8ce7a084e5ce13b78d543fa5589767d33258c9062236f94fab0e6f0d990251ae7362c5337956c062a1aea8944c25fadc1b0cbeeda1d5d402226317b5ed275588ea4b7d9476a7c0af1c0021209fb61ccc58b7471ad4ba43705c932ec4639082e17100a152069a8fe4751e41221910c15d2877d5b831d8b6aa6b4d563976cda8683611272b504224166ff92784076677c1b126d2f940ce9fd415f25614d289000000000000e000000000000000090120007f0000004ef49be023566f173c18dbd68e618ac1733d4c680121dac8f8ff47f200688b33c2af1b9c7a1cbe28d0dfb40f457607c0f341908f5e762cd06b8b2cc567cd759730cb6743979595e0eef2a797ec1a5c9f5d341b0f73f3d9299deba966081da47d20b6c21091cad2504ae9d59adcb0c50d614a17744854211b971d94806367abfe74148bacd4e9cea1cb5e58e8839e967b7fad7b9f881911f3f3ea7381c615ffcd802dc86011bf1e1e278e915512aeda450dfa4fc585a01a575a5e625de1d0cbca097c288283f338d581bc850000000000f0000000000000001201000005000000647931053ced20efaefb230cf2c9b753184a09741b1fb504a8c2684eea4b74cb3fc719b666241418f3ce0f83a55f3b3218d7568e1e0426d7e2b8a780ec9c8d5ebfb2feb1ad94456bafa6cd56d17caeffe635abc24dc53b07ab74135673bdf2ac08674cc408da4aa498d4c57ed5234b24394ca56561d0d144c735d34da1cee79fd1a4a390b1d24971e5dba29591de093024365581da52b0d16642beddf6e6a2bbf8e0c3bd3aef1ba2e6fb681e6560305c6fb92487460df9e9d957d69529c43669dc974fb15f87a3b8dac2cd180172f86b5c97f4c1ac4d32e3fd80ac44dfb183b510000000000000009f01000005000000e800000000000000ff01000000020000f6e5b96c4ed77de7cb41c47386e2dabbfb70371fa611c222111212d9fa191f3f3e64c79deac3df6421a8e388eea0674124f70f348a2168847486fcd4e735e11da41978a894b9930a4c01f9ca99fd5eeb863687b6e3854bf0d6fdfc06cc9f251636f85cd71290ea5277a49b975dda35b45e2e394605d67a1fba8a2bda515f2c49bf38bdb3a64ce8f69a4e0021413daf0bf540bbe0a88ca8d7d36f9d15d2dd470a52fffe4e812144b139f175808d12831dd8b608939defff6018edbb5b60f5f08fd39b89901373d260b74fef06609007cdfe72773ea3061e0048000000000000009d01000008000000c191ad56b33b01a2fdccfaa1c2147fbf48aa8cd8907ef8a8744fcbb419aa7819f9013e0e12bb19b3eeb3eeefb8a1c1c58785caa6c0000000272a3bb6a978dec264b83bc3a30374faebfa0aefd083f33d61406c78f6c8949214dff386e3d2a6757b77e4a06a19ee6dedca0ed0398c91452016c6dcb7cd23caae41cfedbecf9b6fbdf3f26874eef7587da0c66f9281dd2e3ffdc24c13bd29f0254c47e93d7fbe8b84257b106ee8949734dd6c907fac1929dc7801ea61e4b79a958a9c90d5482fd972a2022910ec78036b75ccf308564da7a2b4b79be45e271a7dbf7ff3b29d5dbaf5437c8399a77b767961c7d9b0fb1188649da0400f37f7eb12ef491878245994381076e60c6d5f9ac3537abfb6186ddef9c9cf10783cfd9008e455bf4589776629"], 0x440, 0xc0}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) socket$unix(0x1, 0x5, 0x0) getsockopt$packet_int(r1, 0x107, 0x8, &(0x7f0000000900), &(0x7f0000000940)=0x4) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000480)={0x0, 0x1, 0x1, 0x8}, &(0x7f00000004c0)=0x10) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000500)={r2, 0xffff}, &(0x7f0000000540)=0x8) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000980)) 12:00:59 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) 12:00:59 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x300]}}, 0x1c) 12:00:59 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x78, 0x400000000000) 12:00:59 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667302", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:00:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x700, &(0x7f0000000480)="bce854e9"}) [ 446.984750] binder: undelivered TRANSACTION_ERROR: 29189 [ 447.004623] binder: send failed reply for transaction 844, target dead 12:00:59 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000]}) 12:00:59 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xb3, 0x400000000000) [ 447.111507] binder: 18298:18305 transaction failed 29201/-71, size 0-0 line 2741 [ 447.125472] binder_alloc: binder_alloc_mmap_handler: 18298 20001000-20004000 already mapped failed -16 [ 447.136218] net_ratelimit: 3 callbacks suppressed [ 447.136229] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 447.136692] binder: BINDER_SET_CONTEXT_MGR already set 12:00:59 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x91ffffff]}}, 0x1c) [ 447.245321] binder_alloc: 18298: binder_alloc_buf, no vma [ 447.272554] binder: 18298:18312 transaction failed 29189/-3, size 0-0 line 2973 [ 447.274229] binder: 18298:18324 transaction failed 29201/-71, size 0-0 line 2741 12:00:59 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) [ 447.320543] binder: release 18298:18305 transaction 849 out, still active [ 447.327905] binder: undelivered TRANSACTION_COMPLETE 12:00:59 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x166, 0x400000000000) 12:00:59 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="786673ff", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 447.364786] binder: send failed reply for transaction 849, target dead [ 447.428722] binder: 18298:18305 ioctl 40046207 0 returned -16 [ 447.445656] binder: undelivered TRANSACTION_ERROR: 29189 12:00:59 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xb8ff]}}, 0x1c) 12:00:59 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) 12:00:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x74, &(0x7f0000000480)="bce854e9"}) 12:00:59 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x24d9, 0x400) ioctl$TIOCGWINSZ(r1, 0x5413, &(0x7f0000000040)) 12:00:59 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xea, 0x400000000000) 12:00:59 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 447.795301] binder_transaction: 14 callbacks suppressed [ 447.795311] binder: 18364:18370 got reply transaction with no transaction stack 12:00:59 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x11]}}, 0x1c) 12:00:59 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000]}) 12:00:59 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x18e, 0x400000000000) [ 447.867533] binder: 18364:18370 transaction failed 29201/-71, size 0-0 line 2741 [ 447.924842] binder: BINDER_SET_CONTEXT_MGR already set [ 447.940530] XFS (loop3): Invalid superblock magic number [ 447.946910] binder: 18364:18398 got reply transaction with no transaction stack [ 447.954974] binder_alloc: 18364: binder_alloc_buf, no vma 12:01:00 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) [ 447.970196] binder: 18364:18370 ioctl 40046207 0 returned -16 [ 447.981538] binder: 18364:18393 transaction failed 29189/-3, size 0-0 line 2973 12:01:00 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xed5596ea]}}, 0x1c) 12:01:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x43000000, &(0x7f0000000480)="bce854e9"}) 12:01:00 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x15d, 0x400000000000) 12:01:00 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 448.084649] binder: undelivered TRANSACTION_ERROR: 29189 12:01:00 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f]}) [ 448.251276] binder: 18418:18428 got reply transaction with no transaction stack [ 448.294883] binder: 18418:18428 ioctl c0306201 200001c0 returned -14 [ 448.327989] binder: BINDER_SET_CONTEXT_MGR already set [ 448.329380] binder: 18418:18437 got reply transaction with no transaction stack [ 448.372910] binder: 18418:18428 ioctl 40046207 0 returned -16 [ 448.393245] binder_alloc: 18418: binder_alloc_buf, no vma [ 448.429268] XFS (loop3): Invalid superblock magic number [ 448.435567] binder: 18418:18437 ioctl c0306201 200001c0 returned -14 12:01:00 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000000)={0x9, {{0xa, 0x4e22, 0xe13, @dev={0xfe, 0x80, [], 0x1f}, 0x5}}}, 0x88) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x200800, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r1, 0x6, 0x2, &(0x7f0000000140), &(0x7f0000000180)=0x6) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:00 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x5000000000000]}}, 0x1c) 12:01:00 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x14, 0x400000000000) 12:01:00 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) 12:01:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x6000, &(0x7f0000000480)="bce854e9"}) [ 448.495170] binder: undelivered TRANSACTION_ERROR: 29189 12:01:00 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x9f, 0x400000000000) [ 448.576190] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 448.589472] binder: 18457:18464 got reply transaction with no transaction stack [ 448.605050] binder: BINDER_SET_CONTEXT_MGR already set [ 448.616340] binder: 18457:18464 ioctl 40046207 0 returned -16 12:01:00 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\b', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:00 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x4000000]}}, 0x1c) [ 448.644754] binder: 18457:18469 got reply transaction with no transaction stack 12:01:00 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) 12:01:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x600, &(0x7f0000000480)="bce854e9"}) [ 448.735075] binder: undelivered TRANSACTION_ERROR: 29189 [ 448.774756] binder: send failed reply for transaction 864 to 18457:18464 [ 448.781954] binder: undelivered TRANSACTION_ERROR: 29189 12:01:00 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x66, 0x400000000000) [ 448.809617] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:00 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x900]}}, 0x1c) [ 448.865120] binder: 18486:18491 got reply transaction with no transaction stack [ 448.920741] binder_alloc_mmap_handler: 3 callbacks suppressed [ 448.920759] binder_alloc: binder_alloc_mmap_handler: 18486 20001000-20004000 already mapped failed -16 [ 448.963261] binder: BINDER_SET_CONTEXT_MGR already set [ 448.969652] binder: 18486:18506 got reply transaction with no transaction stack [ 448.970839] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 448.977607] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 448.977615] binder_alloc: 18486: binder_alloc_buf, no vma [ 448.999446] binder: 18486:18491 ioctl 40046207 0 returned -16 [ 449.018769] binder_thread_release: 2 callbacks suppressed [ 449.018780] binder: release 18486:18491 transaction 869 out, still active [ 449.074610] binder_release_work: 3 callbacks suppressed [ 449.074615] binder: undelivered TRANSACTION_COMPLETE 12:01:01 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000000)={0x0, 0x5}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000080)={r1, 0x100000001, 0x3, [0x5, 0x9, 0x3]}, &(0x7f00000000c0)=0xe) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) getrandom(&(0x7f0000000140)=""/3, 0x3, 0x2) 12:01:01 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000]}) 12:01:01 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="786673bc", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:01 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x134, 0x400000000000) 12:01:01 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x2000]}}, 0x1c) 12:01:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x4c00, &(0x7f0000000480)="bce854e9"}) [ 449.144635] binder_send_failed_reply: 2 callbacks suppressed [ 449.144643] binder: send failed reply for transaction 869, target dead [ 449.265295] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 449.267833] binder: 18520:18526 got reply transaction with no transaction stack 12:01:01 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x10f, 0x400000000000) 12:01:01 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) [ 449.310577] binder_alloc: binder_alloc_mmap_handler: 18520 20001000-20004000 already mapped failed -16 [ 449.340384] binder: BINDER_SET_CONTEXT_MGR already set 12:01:01 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x700]}}, 0x1c) [ 449.376498] binder: 18520:18526 ioctl 40046207 0 returned -16 [ 449.403011] binder_alloc: 18520: binder_alloc_buf, no vma 12:01:01 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 449.426170] binder: 18520:18545 got reply transaction with no transaction stack [ 449.444204] binder: release 18520:18526 transaction 874 out, still active [ 449.488232] binder: undelivered TRANSACTION_COMPLETE 12:01:01 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f]}) 12:01:01 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x41, 0x400000000000) [ 449.522061] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 449.584816] binder: send failed reply for transaction 874, target dead [ 449.728662] XFS (loop3): Invalid superblock magic number 12:01:01 executing program 0: r0 = socket$inet6(0xa, 0x2, 0xfffffffffffffffe) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vga_arbiter\x00', 0x1, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240)='/dev/hwrng\x00', 0x10602, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) fcntl$setpipe(r0, 0x407, 0x2) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000000)=ANY=[@ANYBLOB="00000400000067c6af3b02f6aaa97ff25806b04e19ed2bfc31d2267dc7dc3884cc14ba5b7c672c78ff3205b15060079ef72572098b5f754cbda4cd50473fae90da76c54e9fd60da6b93b284808a3cabfa973d14f13e392e3870f252fbdc519e508e796c7e2fc68ee5f96ec91d9c68220c28d25170ad454c83fb228e9eb208d39f609bbf43e5c411df2a245f0ee06be7ebb134c9324757772ff9a085eb5e2c8df1fdae1084dd963bac9c86069781602f5f95393"], 0x8) sendmmsg(r0, &(0x7f0000000180), 0x0, 0x0) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000140)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) setsockopt$inet6_buf(r0, 0x29, 0xca, &(0x7f00000001c0)="f3d95964fb08d95f06652f67a79e1a861d29e02681cc563fdb8f46f5beb2f964edbed7cdf9b8a985c2933aa2f6a233daebc61e6ba6014251f8ba", 0xfffffffffffffdd2) setsockopt$inet6_tcp_int(r0, 0x6, 0x1f, &(0x7f0000000180)=0xff, 0x4) 12:01:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0xfdfdffff00000000, &(0x7f0000000480)="bce854e9"}) 12:01:01 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x218]}}, 0x1c) 12:01:01 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) 12:01:01 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1c5, 0x400000000000) 12:01:01 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 449.865388] binder: 18587:18589 ioctl c0306201 200001c0 returned -14 [ 449.891430] binder_alloc: binder_alloc_mmap_handler: 18587 20001000-20004000 already mapped failed -16 12:01:01 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xfc]}}, 0x1c) 12:01:01 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) [ 449.916908] binder: BINDER_SET_CONTEXT_MGR already set [ 449.923513] binder: 18587:18589 ioctl 40046207 0 returned -16 [ 449.934248] binder_alloc: 18587: binder_alloc_buf, no vma [ 449.934261] binder: 18587:18603 ioctl c0306201 200001c0 returned -14 12:01:02 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xfffffffffffffffc, 0x0, @remote, 0x4}, 0xffffffffffffffc8) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000000)=ANY=[@ANYBLOB="000000001400000031eb51a2c927ca1be8696f148c35543a3f0d20a937384bdfb725360af3b84fafae84002f4ec9e0319f226e88688b9956c3e285b8777c66bc94cc86d5b8c1a43d713ec9150688adf692f9a1effec66df52f0a56519c288db6e8c9c12c008ace0ed873bd65c4e6b6615147fe73927eb38f17cab1a370323eebd67ec987c685051467ebf052e9febeff9aa8f4339112bc693b3a6e4ffbdb9275a2cd375ae230d8dbe1640efa079f2fa5887d74ffcd5851000000000b9a2c1e0f180b702456f4ef9276f32c615c61c9920959fdceb5057fcec59ecbcb"], 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00000001c0)=@sack_info={r1, 0x100, 0x5}, 0xc) 12:01:02 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xad, 0x400000000000) 12:01:02 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xffffffff00000000]}}, 0x1c) 12:01:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x700000000000000, &(0x7f0000000480)="bce854e9"}) [ 450.095670] binder: send failed reply for transaction 879 to 18587:18589 [ 450.103149] binder: undelivered TRANSACTION_COMPLETE 12:01:02 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) [ 450.152542] XFS (loop3): Invalid superblock magic number [ 450.186767] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:02 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) acct(&(0x7f0000000040)='.\x00') ioctl$KVM_GET_FPU(r1, 0x81a0ae8c, &(0x7f0000000200)) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 12:01:02 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x300000000000000]}}, 0x1c) [ 450.223740] binder: 18630:18635 ioctl c0306201 200001c0 returned -14 [ 450.256305] binder_alloc: binder_alloc_mmap_handler: 18630 20001000-20004000 already mapped failed -16 12:01:02 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x141, 0x400000000000) [ 450.274979] binder: BINDER_SET_CONTEXT_MGR already set [ 450.280435] binder: 18630:18635 ioctl 40046207 0 returned -16 [ 450.290899] binder_alloc: 18630: binder_alloc_buf, no vma [ 450.291045] binder: 18630:18649 ioctl c0306201 200001c0 returned -14 [ 450.305250] binder: release 18630:18635 transaction 884 out, still active [ 450.312710] binder: undelivered TRANSACTION_COMPLETE 12:01:02 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x68000000, &(0x7f0000000480)="bce854e9"}) [ 450.341562] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 450.364655] binder: send failed reply for transaction 884, target dead 12:01:02 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000]}) 12:01:02 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x91ffffff00000000]}}, 0x1c) 12:01:02 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x143, 0x400000000000) [ 450.580642] binder: 18667:18673 ioctl c0306201 200001c0 returned -14 [ 450.608813] binder_alloc: binder_alloc_mmap_handler: 18667 20001000-20004000 already mapped failed -16 12:01:02 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) [ 450.636268] binder: BINDER_SET_CONTEXT_MGR already set [ 450.646062] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 450.656881] XFS (loop3): Invalid superblock magic number [ 450.679112] binder: 18667:18673 ioctl 40046207 0 returned -16 12:01:02 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x128, 0x400000000000) [ 450.700066] binder_alloc: 18667: binder_alloc_buf, no vma 12:01:02 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x8000000000000000]}}, 0x1c) 12:01:02 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 450.815406] binder: send failed reply for transaction 889 to 18667:18673 [ 450.828367] binder: undelivered TRANSACTION_COMPLETE [ 450.911390] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:03 executing program 0: r0 = socket$inet6(0xa, 0x40000003, 0x20007fffffffe) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000000)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@dev}}, &(0x7f0000000140)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000200)={{{@in=@loopback, @in, 0x4e22, 0x7f, 0x4e21, 0x5, 0xa, 0x20, 0xa0, 0x5e, 0x0, r1}, {0x0, 0x101, 0x3, 0x3, 0x7, 0x30, 0xfffffffffffffff7, 0x1}, {0xffffffffffffffe0, 0x42, 0x5, 0x6}, 0x8, 0x6e6bb5, 0x0, 0x0, 0x3, 0x3}, {{@in=@local, 0x4d3, 0x33}, 0x2, @in, 0x3507, 0x0, 0x1, 0x9c, 0x0, 0x3f80000000, 0x10000}}, 0xe8) sigaltstack(&(0x7f0000ffc000/0x2000)=nil, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x80000, 0x0) ioctl$TUNSETTXFILTER(r2, 0x400454d1, &(0x7f0000000300)={0x1, 0x1, [@remote]}) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0xa000000, &(0x7f0000000480)="bce854e9"}) 12:01:03 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xed, 0x400000000000) 12:01:03 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f]}) 12:01:03 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xc4ffffff]}}, 0x1c) [ 451.038210] XFS (loop3): Invalid superblock magic number 12:01:03 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x9000000]}}, 0x1c) [ 451.166112] binder: 18733:18743 ioctl c0306201 200001c0 returned -14 12:01:03 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x91, 0x400000000000) 12:01:03 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000]}) [ 451.214759] binder_alloc: binder_alloc_mmap_handler: 18733 20001000-20004000 already mapped failed -16 [ 451.241777] binder: BINDER_SET_CONTEXT_MGR already set [ 451.259288] binder: 18733:18743 ioctl 40046207 0 returned -16 12:01:03 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667303", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:03 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x4, 0x10000, 0xfffffffffffffffc, 0x101}, {0x3f, 0x1, 0xb23, 0xffff}]}, 0x10) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) [ 451.296785] binder: 18733:18759 ioctl c0306201 200001c0 returned -14 [ 451.312263] binder_alloc: 18733: binder_alloc_buf, no vma [ 451.321672] binder: release 18733:18743 transaction 893 out, still active 12:01:03 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x3a, 0x400000000000) [ 451.367948] binder: undelivered TRANSACTION_COMPLETE 12:01:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x4000000, &(0x7f0000000480)="bce854e9"}) [ 451.414666] binder_release_work: 7 callbacks suppressed [ 451.414674] binder: undelivered TRANSACTION_ERROR: 29189 12:01:03 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xff0f]}}, 0x1c) 12:01:03 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) [ 451.474775] binder: send failed reply for transaction 893, target dead 12:01:03 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1e2, 0x400000000000) [ 451.569784] binder_transaction: 24 callbacks suppressed [ 451.569801] binder: 18781:18790 transaction failed 29201/-71, size 0-0 line 2741 12:01:03 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="786673ff", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 451.612668] binder: 18781:18790 ioctl c0306201 200001c0 returned -14 [ 451.625760] binder_alloc: binder_alloc_mmap_handler: 18781 20001000-20004000 already mapped failed -16 [ 451.635981] binder: BINDER_SET_CONTEXT_MGR already set [ 451.641617] binder: 18781:18790 ioctl 40046207 0 returned -16 [ 451.668023] binder_alloc: 18781: binder_alloc_buf, no vma [ 451.668130] binder: 18781:18800 transaction failed 29201/-71, size 0-0 line 2741 [ 451.704678] binder: 18781:18795 transaction failed 29189/-3, size 0-0 line 2973 12:01:03 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f]}) [ 451.739615] binder: release 18781:18790 transaction 898 out, still active [ 451.748285] binder: undelivered TRANSACTION_COMPLETE [ 451.764423] binder: undelivered TRANSACTION_ERROR: 29189 [ 451.772666] binder: 18781:18800 ioctl c0306201 200001c0 returned -14 12:01:03 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x600000000000000]}}, 0x1c) 12:01:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x7400, &(0x7f0000000480)="bce854e9"}) 12:01:03 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x127, 0x400000000000) [ 451.864653] binder: send failed reply for transaction 898, target dead 12:01:03 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 451.986268] binder: 18821:18823 transaction failed 29201/-71, size 0-0 line 2741 [ 452.036881] binder_alloc: binder_alloc_mmap_handler: 18821 20001000-20004000 already mapped failed -16 [ 452.080422] binder: BINDER_SET_CONTEXT_MGR already set [ 452.102108] binder: 18821:18823 ioctl 40046207 0 returned -16 [ 452.109540] binder_alloc: 18821: binder_alloc_buf, no vma [ 452.122073] binder: 18821:18841 transaction failed 29201/-71, size 0-0 line 2741 [ 452.129962] binder: 18821:18832 transaction failed 29189/-3, size 0-0 line 2973 [ 452.139373] binder: release 18821:18823 transaction 903 out, still active [ 452.139700] XFS (loop3): Invalid superblock magic number [ 452.149783] binder: undelivered TRANSACTION_COMPLETE 12:01:04 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x1011020000000000]}}, 0x1c) 12:01:04 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) 12:01:04 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x133, 0x400000000000) [ 452.214703] binder: undelivered TRANSACTION_ERROR: 29189 12:01:04 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) r1 = geteuid() setfsuid(r1) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000c40)=ANY=[@ANYBLOB="b2529db85355f6b019c6717d0104fc0eb46d23cc17c1f9d562e0a75fe4e5464fa0049d30c82b2b2463c500257f63c7f2d0e273b6f0ee77320839a78fe2acc254c8026af5a57854dc858231604ca49cf15d27a22584"], 0x8) write$binfmt_elf64(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="7f454c460509ffffffff00000000000003003f00ff070000800100000000000040000000000000002b0200000000000003000000ffff38000200ff0f0400480d0200000005000000d300000000000000030000000000000000040000000000000500000000000000200000000000000006000000000000003c634ac529aabc7f803ad83192e00c69dd62aeced1f8ae79bbc5d133d3033fdf95b5bd4645ef4154bd5a0eed1e96a305fd56ee408df6efc97130b0160ab7562c8c62568d1173427918f043b3965f0ec8373ee22284b0db0fd1efaa8e9230f8d3343fabee267d02c3da8d40466e4ea9df5c383e9d3c6c090d1b76fca3d901541a2eac3d31e6b950bb0ef5c7db2d8c74fe34cca8685869a2ba113ef2aba8aceced5a38906add6e689641fceec4d6037200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0xa27) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x20000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080)={0xffffffffffffffff}, 0x106}}, 0x20) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x20000, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(r2, &(0x7f0000000180)={0x12, 0x10, 0xfa00, {&(0x7f0000000040), r3, r4}}, 0x18) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x7a, &(0x7f0000000480)="bce854e9"}) [ 452.290214] binder: send failed reply for transaction 903, target dead [ 452.319397] net_ratelimit: 2 callbacks suppressed [ 452.319407] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 452.337726] binder: 18850:18858 transaction failed 29201/-71, size 0-0 line 2741 12:01:04 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xcc, 0x400000000000) [ 452.370186] binder_alloc: binder_alloc_mmap_handler: 18850 20001000-20004000 already mapped failed -16 12:01:04 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xdc7f000000000000]}}, 0x1c) [ 452.411657] binder: BINDER_SET_CONTEXT_MGR already set [ 452.418188] binder: 18850:18869 transaction failed 29201/-71, size 0-0 line 2741 12:01:04 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:04 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) [ 452.469772] binder: release 18850:18858 transaction 908 out, still active [ 452.477369] binder_alloc: 18850: binder_alloc_buf, no vma [ 452.487860] binder: undelivered TRANSACTION_COMPLETE 12:01:04 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1f2, 0x400000000000) [ 452.531381] binder: 18850:18858 ioctl 40046207 0 returned -16 [ 452.538671] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 452.544665] binder: send failed reply for transaction 908, target dead [ 452.570980] binder: 18850:18867 transaction failed 29189/-3, size 0-0 line 2973 12:01:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x60000000, &(0x7f0000000480)="bce854e9"}) [ 452.654732] binder: undelivered TRANSACTION_ERROR: 29189 12:01:04 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) 12:01:04 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x18020000]}}, 0x1c) [ 452.705385] XFS (loop3): Invalid superblock magic number [ 452.766602] binder: 18903:18905 transaction failed 29201/-71, size 0-0 line 2741 [ 452.797959] binder: 18903:18905 ioctl c0306201 200001c0 returned -14 12:01:04 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x7c, 0x400000000000) [ 452.837564] binder_alloc: binder_alloc_mmap_handler: 18903 20001000-20004000 already mapped failed -16 [ 452.847611] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 452.853550] binder: BINDER_SET_CONTEXT_MGR already set [ 452.867476] binder_alloc: 18903: binder_alloc_buf, no vma 12:01:04 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) [ 452.900899] binder: 18903:18905 ioctl 40046207 0 returned -16 [ 453.004745] binder: undelivered TRANSACTION_ERROR: 29189 [ 453.064743] binder: send failed reply for transaction 913 to 18903:18905 [ 453.080665] binder: undelivered TRANSACTION_COMPLETE [ 453.092275] binder: undelivered TRANSACTION_ERROR: 29189 12:01:05 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x400000, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r1, 0x114, 0x1, &(0x7f0000000040)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10) sendmmsg(r0, &(0x7f0000001780), 0x3, 0x4000) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:05 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:05 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xfe80]}}, 0x1c) 12:01:05 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1f6, 0x400000000000) 12:01:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0xffffff7f, &(0x7f0000000480)="bce854e9"}) 12:01:05 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f]}) [ 453.221887] binder_transaction: 14 callbacks suppressed [ 453.221897] binder: 18939:18950 got reply transaction with no transaction stack 12:01:05 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) 12:01:05 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x7]}}, 0x1c) [ 453.274438] binder: 18939:18950 ioctl c0306201 200001c0 returned -14 [ 453.333353] binder: BINDER_SET_CONTEXT_MGR already set 12:01:05 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r1, &(0x7f0000000040)={0x2, 0xffffffffffffff04}, 0x2) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:05 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x29, 0x400000000000) [ 453.359330] XFS (loop3): Invalid superblock magic number [ 453.363781] binder: 18939:18973 got reply transaction with no transaction stack [ 453.369173] binder: 18939:18950 ioctl 40046207 0 returned -16 [ 453.381994] binder: 18939:18973 ioctl c0306201 200001c0 returned -14 [ 453.390793] binder: release 18939:18950 transaction 917 out, still active 12:01:05 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x5]}}, 0x1c) [ 453.445062] binder: undelivered TRANSACTION_ERROR: 29189 12:01:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0xffffff7f00000000, &(0x7f0000000480)="bce854e9"}) 12:01:05 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000]}) [ 453.485216] binder: send failed reply for transaction 917, target dead 12:01:05 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667302", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:05 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x43, 0x400000000000) 12:01:05 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x1f4]}}, 0x1c) [ 453.672469] binder: 18995:19000 got reply transaction with no transaction stack [ 453.711564] binder: 18995:19000 ioctl c0306201 200001c0 returned -14 [ 453.742834] binder: BINDER_SET_CONTEXT_MGR already set 12:01:05 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) signalfd(r0, &(0x7f0000000040)={0x100}, 0x8) [ 453.764096] binder: 18995:19016 got reply transaction with no transaction stack [ 453.791496] binder: 18995:19000 ioctl 40046207 0 returned -16 12:01:05 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1eb, 0x400000000000) [ 453.818521] binder: release 18995:19000 transaction 922 out, still active [ 453.826732] binder: 18995:19016 ioctl c0306201 200001c0 returned -14 [ 453.835899] binder: undelivered TRANSACTION_ERROR: 29189 12:01:05 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x7000000, &(0x7f0000000480)="bce854e9"}) [ 453.904781] binder: send failed reply for transaction 922, target dead 12:01:06 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhci\x00', 0x40000, 0x0) setsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000000140)=0x3, 0x2) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=ANY=[@ANYBLOB="0001040000000000"], 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x8001, 0x204000) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000080)) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f0000000040)=0x100, 0x4) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:06 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xea9655ed]}}, 0x1c) 12:01:06 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000140)={{}, 0x0, 0x0, 0x1e, {0x0, 0x8}, 0x0, 0x1008}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x1, 0x0) ioctl$UI_DEV_DESTROY(r1, 0x5502) ioctl$RTC_IRQP_READ(r1, 0x8008700b, &(0x7f0000000040)) [ 454.042378] binder: 19032:19033 got reply transaction with no transaction stack [ 454.080653] binder: 19032:19033 ioctl c0306201 200001c0 returned -14 12:01:06 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x6f, 0x400000000000) 12:01:06 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x8b37631600000000]}}, 0x1c) [ 454.144649] binder_alloc_mmap_handler: 2 callbacks suppressed [ 454.144685] binder_alloc: binder_alloc_mmap_handler: 19032 20001000-20004000 already mapped failed -16 12:01:06 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{0xfffffffffffffffd}, 0x0, 0x0, 0x0, {0x0, 0xa07}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000000)={0x4, 0x7, 0x6, {}, 0x8, 0x5}) r1 = syz_open_dev$vcsn(&(0x7f0000000140)='/dev/vcs#\x00', 0x9, 0x119000) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000000180)={0x0, 0x3}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f0000000200)={r2, 0x8}, 0x8) [ 454.190160] binder: BINDER_SET_CONTEXT_MGR already set [ 454.199272] XFS (loop3): Invalid superblock magic number [ 454.236057] binder: 19032:19033 ioctl 40046207 0 returned -16 [ 454.284142] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 454.311491] binder_alloc_new_buf_locked: 2 callbacks suppressed [ 454.311500] binder_alloc: 19032: binder_alloc_buf, no vma 12:01:06 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xe9, 0x400000000000) 12:01:06 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x6000000]}}, 0x1c) [ 454.351355] binder: 19032:19055 got reply transaction with no transaction stack [ 454.385027] binder: release 19032:19033 transaction 927 out, still active 12:01:06 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs(', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:06 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x10000000) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) [ 454.395898] binder: 19032:19055 ioctl c0306201 200001c0 returned -14 [ 454.402582] binder_release_work: 2 callbacks suppressed [ 454.402587] binder: undelivered TRANSACTION_COMPLETE [ 454.420371] binder: undelivered TRANSACTION_ERROR: 29189 12:01:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x7, &(0x7f0000000480)="bce854e9"}) 12:01:06 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x14d, 0x400000000000) [ 454.524696] binder: send failed reply for transaction 927, target dead [ 454.525423] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 454.639308] binder: 19093:19099 got reply transaction with no transaction stack 12:01:06 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x4000) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00D\x00\x00\x00\x00\x00'], 0x8) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000140)={'nat\x00'}, &(0x7f00000000c0)=0x78) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x200004, 0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r1, 0xc0045520, &(0x7f0000000040)=0x7fffffff) 12:01:06 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x5400]}}, 0x1c) 12:01:06 executing program 4: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) r2 = syz_open_dev$usbmon(&(0x7f0000000740)='/dev/usbmon#\x00', 0x6, 0x100) getpeername$llc(r2, &(0x7f0000000780)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f00000007c0)=0x10) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000280)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@multicast1, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@local}}, &(0x7f00000003c0)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000400)={{{@in6=@remote, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@local}}, &(0x7f0000000500)=0xe8) stat(&(0x7f0000000540)='\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$amidi(&(0x7f0000000800)='/dev/amidi#\x00', 0xffffffffffffff75, 0x200000) getresgid(&(0x7f0000000600)=0x0, &(0x7f0000000640)=0x0, &(0x7f0000000680)) fsetxattr$system_posix_acl(r0, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f00000006c0)=ANY=[@ANYBLOB="02000000010007000000000002000100", @ANYRES32=r3, @ANYBLOB="02000200", @ANYRES32=r4, @ANYBLOB="02000200", @ANYRES32=r5, @ANYBLOB="0200ca19", @ANYRES32=r6, @ANYBLOB="02000200", @ANYRES32=r7, @ANYBLOB="040004000000000008000200", @ANYRES32=r8, @ANYBLOB="10000200000000002000070000000000"], 0x54, 0x3) write$P9_RGETATTR(r2, &(0x7f0000000840)={0xa0, 0x19, 0x1, {0x2000, {0x40, 0x0, 0x2}, 0x1, r7, r9, 0x0, 0x90, 0x3f, 0x6, 0xff, 0x4, 0x1, 0x19400000000, 0x80000000, 0x80000000, 0x7fffffff, 0x7, 0x8d, 0x3, 0x93b6}}, 0xa0) [ 454.682978] binder_alloc: binder_alloc_mmap_handler: 19093 20001000-20004000 already mapped failed -16 [ 454.705895] binder: BINDER_SET_CONTEXT_MGR already set [ 454.717409] binder: 19093:19099 ioctl 40046207 0 returned -16 12:01:06 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 454.762890] binder: 19093:19115 got reply transaction with no transaction stack [ 454.798722] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:06 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x70, 0x400000000000) [ 454.809680] binder: release 19093:19099 transaction 932 out, still active [ 454.815083] binder_alloc: 19093: binder_alloc_buf, no vma [ 454.816772] binder: undelivered TRANSACTION_COMPLETE 12:01:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x6000000000000000, &(0x7f0000000480)="bce854e9"}) 12:01:06 executing program 4: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = dup2(r0, r0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000000)={0x8, 0x200}) openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x20000, 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ion\x00', 0x40a041, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r2, 0xc0bc5351, &(0x7f0000000080)) [ 454.875950] binder: undelivered TRANSACTION_ERROR: 29189 12:01:06 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x8010017d00000000]}}, 0x1c) [ 454.924868] binder: send failed reply for transaction 932, target dead 12:01:07 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xa0, 0x400000000000) [ 455.026844] binder: 19134:19141 got reply transaction with no transaction stack [ 455.073282] binder: 19134:19141 ioctl c0306201 200001c0 returned -14 [ 455.100254] binder_alloc: binder_alloc_mmap_handler: 19134 20001000-20004000 already mapped failed -16 [ 455.111114] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:07 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/conn_reuse_mode\x00', 0x2, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000180)) r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x800000000001) close(r1) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r2, 0xc0bc5351, &(0x7f0000000080)) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x1c000, 0x0) ioctl$EVIOCSREP(r3, 0x40084503, &(0x7f0000000040)=[0x1f9c, 0x7fffffff]) [ 455.146164] binder: BINDER_SET_CONTEXT_MGR already set [ 455.157079] binder: 19134:19159 got reply transaction with no transaction stack [ 455.169125] XFS (loop3): Invalid superblock magic number [ 455.176336] binder: 19134:19141 ioctl 40046207 0 returned -16 [ 455.179730] binder_alloc: 19134: binder_alloc_buf, no vma 12:01:07 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x17c, 0x400000000000) 12:01:07 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x10110200]}}, 0x1c) [ 455.194805] binder: 19134:19159 ioctl c0306201 200001c0 returned -14 [ 455.202167] binder: release 19134:19141 transaction 937 out, still active [ 455.222241] binder: undelivered TRANSACTION_COMPLETE [ 455.295152] binder: send failed reply for transaction 937, target dead [ 455.344535] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:07 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0xfdfdffff, &(0x7f0000000480)="bce854e9"}) 12:01:07 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x11000000]}}, 0x1c) 12:01:07 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xe3, 0x400000000000) 12:01:07 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x8) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000040)={0x1, 0x4ece, 0x2, 0x4, 0x1, 0xfffffffffffffff9}, 0xc) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:07 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x1000000000000000) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) [ 455.618889] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 455.629257] binder: 19193:19199 ioctl c0306201 200001c0 returned -14 12:01:07 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1d, 0x400000000000) 12:01:07 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xfec0]}}, 0x1c) [ 455.662665] binder_alloc: binder_alloc_mmap_handler: 19193 20001000-20004000 already mapped failed -16 [ 455.698862] binder: BINDER_SET_CONTEXT_MGR already set [ 455.706651] binder: 19193:19216 ioctl c0306201 200001c0 returned -14 12:01:07 executing program 4: r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x3, 0x200000) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x300, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_origin(r1, &(0x7f0000000140)='trusted.overlay.origin\x00', &(0x7f0000000180)='y\x00', 0x2, 0x3) r2 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x2c, r3, 0x800, 0x70bd25, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x5f2e55e4}]}, 0x2c}}, 0x1) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x27, &(0x7f00000002c0)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r4, 0x0, 0x29, &(0x7f00000003c0)=ANY=[@ANYBLOB="e99e908f825ede4193825ee00000027f0000010000000000000000"], 0x10) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r2, 0xc0bc5351, &(0x7f0000000080)={{0x20}}) [ 455.713595] binder_alloc: 19193: binder_alloc_buf, no vma [ 455.719407] binder: 19193:19199 ioctl 40046207 0 returned -16 [ 455.725805] binder: release 19193:19199 transaction 942 out, still active [ 455.764819] XFS (loop3): Invalid superblock magic number [ 455.768028] binder: undelivered TRANSACTION_COMPLETE 12:01:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x4300, &(0x7f0000000480)="bce854e9"}) 12:01:07 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x16c, 0x400000000000) [ 455.865243] binder: send failed reply for transaction 942, target dead 12:01:07 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:07 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x1663378b]}}, 0x1c) [ 455.925159] binder_alloc: binder_alloc_mmap_handler: 19237 20001000-20004000 already mapped failed -16 [ 455.935608] binder: BINDER_SET_CONTEXT_MGR already set [ 455.941121] binder: 19237:19240 ioctl 40046207 0 returned -16 [ 455.947812] binder_alloc: 19237: binder_alloc_buf, no vma [ 455.980957] binder: release 19237:19240 transaction 947 out, still active [ 455.999450] binder: undelivered TRANSACTION_COMPLETE 12:01:08 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x1000, 0x4240) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000040)={0x0, 0x0, 0x7, 0x5, 0x5, 0xde81}, &(0x7f0000000140)=0x14) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000180)=@sack_info={r2, 0x0, 0x6}, &(0x7f00000001c0)=0xc) 12:01:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x60, &(0x7f0000000480)="bce854e9"}) [ 456.094753] binder: send failed reply for transaction 947, target dead 12:01:08 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x100000000000000]}}, 0x1c) [ 456.178383] XFS (loop3): Invalid superblock magic number [ 456.267109] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 456.287329] binder_alloc: binder_alloc_mmap_handler: 19267 20001000-20004000 already mapped failed -16 [ 456.333069] binder: BINDER_SET_CONTEXT_MGR already set [ 456.347038] binder: 19267:19271 ioctl 40046207 0 returned -16 [ 456.365768] binder_alloc: 19267: binder_alloc_buf, no vma [ 456.366743] binder: release 19267:19271 transaction 952 out, still active [ 456.383853] binder: undelivered TRANSACTION_COMPLETE 12:01:08 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x1) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x8000000000000, 0xffffffffffffffff, @loopback}, 0x6de5d76f00658ce) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:08 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x13c, 0x400000000000) 12:01:08 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xe803000000000000]}}, 0x1c) 12:01:08 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:08 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_rr_get_interval(r0, &(0x7f0000000100)) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) r2 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x10) r3 = getpid() ioctl$SG_EMULATED_HOST(r2, 0x2203, &(0x7f0000000180)) ptrace$peek(0x3, r3, &(0x7f0000000140)) getsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f0000000040), 0x2) socket$packet(0x11, 0x3, 0x300) 12:01:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x400000000000000, &(0x7f0000000480)="bce854e9"}) [ 456.434851] binder: send failed reply for transaction 952, target dead 12:01:08 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x6d, 0x400000000000) [ 456.538609] binder: 19296:19299 ioctl c0306201 200001c0 returned -14 [ 456.578621] binder_alloc: binder_alloc_mmap_handler: 19296 20001000-20004000 already mapped failed -16 12:01:08 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xf5ffffff00000000]}}, 0x1c) [ 456.629601] binder: BINDER_SET_CONTEXT_MGR already set [ 456.635728] XFS (loop3): Invalid superblock magic number [ 456.646430] binder: 19296:19299 ioctl 40046207 0 returned -16 12:01:08 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000140)={0x4, @time={r1, r2+10000000}, 0x2, {0x1000, 0xff}, 0x4, 0x0, 0x2}) [ 456.679378] binder_transaction: 26 callbacks suppressed [ 456.679396] binder: 19296:19310 transaction failed 29201/-71, size 0-0 line 2741 12:01:08 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xb5, 0x400000000000) [ 456.725032] binder_alloc: 19296: binder_alloc_buf, no vma [ 456.754855] binder: 19296:19310 ioctl c0306201 200001c0 returned -14 [ 456.761968] binder: send failed reply for transaction 957 to 19296:19299 12:01:08 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev}, 0x1c) syz_open_dev$usbmon(&(0x7f00000003c0)='/dev/usbmon#\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000080)) ioprio_set$uid(0x0, 0x0, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x0, 0x0) ioctl$VHOST_GET_FEATURES(r1, 0x80044dff, &(0x7f00000001c0)) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x6800, &(0x7f0000000480)="bce854e9"}) 12:01:08 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x20000000000]}}, 0x1c) [ 456.772643] binder: 19296:19299 transaction failed 29189/-3, size 0-0 line 2973 12:01:08 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:08 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1e6, 0x400000000000) [ 456.827056] binder_release_work: 4 callbacks suppressed [ 456.827063] binder: undelivered TRANSACTION_ERROR: 29189 12:01:08 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) [ 456.920277] binder: undelivered TRANSACTION_COMPLETE [ 456.931975] binder: 19353:19354 transaction failed 29201/-71, size 0-0 line 2741 [ 456.965530] binder: undelivered TRANSACTION_ERROR: 29189 [ 457.001541] binder_alloc: binder_alloc_mmap_handler: 19353 20001000-20004000 already mapped failed -16 12:01:09 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xe8030000]}}, 0x1c) [ 457.028904] binder: BINDER_SET_CONTEXT_MGR already set [ 457.034977] binder: 19353:19354 ioctl 40046207 0 returned -16 [ 457.042006] binder_alloc: 19353: binder_alloc_buf, no vma [ 457.052682] binder: 19353:19376 transaction failed 29201/-71, size 0-0 line 2741 12:01:09 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x58, 0x400000000000) 12:01:09 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x109900, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f00000026c0)={0x9, 0x0, [{0x115001, 0xe6, &(0x7f0000000280)=""/230}, {0x4, 0x45, &(0x7f0000000180)=""/69}, {0x0, 0xa8, &(0x7f0000000380)=""/168}, {0xd000, 0xb7, &(0x7f0000000440)=""/183}, {0x4, 0x8d, &(0x7f0000000500)=""/141}, {0xf000, 0x1f, &(0x7f00000005c0)=""/31}, {0xf000, 0x1000, &(0x7f0000000600)=""/4096}, {0x0, 0xb6, &(0x7f0000001600)=""/182}, {0x107002, 0x1000, &(0x7f00000016c0)=""/4096}]}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) socketpair(0xa, 0x5, 0x3f, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000040)=0x9, 0x4) [ 457.072144] binder: 19353:19372 transaction failed 29189/-3, size 0-0 line 2973 [ 457.094237] binder: release 19353:19354 transaction 962 out, still active [ 457.095257] XFS (loop3): Invalid superblock magic number [ 457.115070] binder: undelivered TRANSACTION_COMPLETE 12:01:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x300, &(0x7f0000000480)="bce854e9"}) [ 457.164739] binder: undelivered TRANSACTION_ERROR: 29189 [ 457.195328] binder: send failed reply for transaction 962, target dead 12:01:09 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xa]}}, 0x1c) 12:01:09 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1bf, 0x400000000000) [ 457.264414] binder: 19398:19400 transaction failed 29201/-71, size 0-0 line 2741 [ 457.282472] binder_alloc: binder_alloc_mmap_handler: 19398 20001000-20004000 already mapped failed -16 [ 457.306724] binder: BINDER_SET_CONTEXT_MGR already set [ 457.312870] binder: 19398:19404 transaction failed 29201/-71, size 0-0 line 2741 [ 457.321406] binder_alloc: 19398: binder_alloc_buf, no vma [ 457.328713] binder: 19398:19400 ioctl 40046207 0 returned -16 [ 457.340125] binder: 19398:19402 transaction failed 29189/-3, size 0-0 line 2973 [ 457.377247] binder: release 19398:19400 transaction 967 out, still active [ 457.393536] binder: undelivered TRANSACTION_COMPLETE [ 457.464832] binder: undelivered TRANSACTION_ERROR: 29189 [ 457.494963] binder: send failed reply for transaction 967, target dead 12:01:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x7a00000000000000, &(0x7f0000000480)="bce854e9"}) 12:01:09 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:09 executing program 4: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x400200, 0x0) ioctl$TIOCCBRK(r2, 0x5428) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@remote}}, &(0x7f0000000000)=0xe8) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000040)={@mcast1, 0xf, r3}) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x60482, 0x0) name_to_handle_at(r4, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000380)={0x87, 0x400, "391400d24581c66419392b6f73d46164a888830a916cd893a62ca1871d522b6e6e581cf15556af773f20d344214c713a7f120372636e880424c5d1df57b157f86eae2af7408692e3d483b127b4430816a76a8bb043e2c18c433a524ee7d3344107391559215477c17283995b6e4f6044525ca760d128775c3dcebe80eb7926"}, &(0x7f0000000440), 0x400) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) 12:01:09 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f0000000000)={'teql0\x00', {0x2, 0x4e22, @local}}) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:09 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x1100000000000000]}}, 0x1c) 12:01:09 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x93, 0x400000000000) [ 457.608514] binder: 19421:19428 transaction failed 29201/-71, size 0-0 line 2741 [ 457.633473] net_ratelimit: 4 callbacks suppressed [ 457.633484] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 457.640967] binder: 19421:19428 ioctl c0306201 200001c0 returned -14 12:01:09 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc0bc5351, &(0x7f0000000080)) 12:01:09 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1da, 0x400000000000) 12:01:09 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x7000000]}}, 0x1c) [ 457.695530] binder_alloc: binder_alloc_mmap_handler: 19421 20001000-20004000 already mapped failed -16 [ 457.729428] XFS (loop3): Invalid superblock magic number [ 457.740467] binder: BINDER_SET_CONTEXT_MGR already set [ 457.753584] binder: 19421:19428 ioctl 40046207 0 returned -16 [ 457.765236] binder_alloc: 19421: binder_alloc_buf, no vma [ 457.781908] binder: 19421:19454 transaction failed 29201/-71, size 0-0 line 2741 12:01:09 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x400200, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000000280)={{0x7, 0x3}, 'port0\x00', 0x6, 0x4, 0x1, 0x100000001, 0x3ff, 0x2, 0x4, 0x0, 0x5, 0x6}) r1 = syz_open_dev$sndseq(&(0x7f0000000140)='/dev/snd/seq\x00', 0x0, 0x244801) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) [ 457.816609] binder: release 19421:19428 transaction 972 out, still active [ 457.824392] binder: 19421:19454 ioctl c0306201 200001c0 returned -14 [ 457.825382] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 457.836562] binder: undelivered TRANSACTION_COMPLETE 12:01:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0xa00000000000000, &(0x7f0000000480)="bce854e9"}) 12:01:09 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xfc, 0x400000000000) 12:01:09 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:09 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xe803]}}, 0x1c) [ 457.914915] binder: undelivered TRANSACTION_ERROR: 29189 [ 457.964292] binder: send failed reply for transaction 972, target dead [ 457.986557] binder: 19470:19471 ioctl c0306201 200001c0 returned -14 [ 458.015908] binder: BINDER_SET_CONTEXT_MGR already set 12:01:10 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1f9, 0x400000000000) [ 458.065095] binder: 19470:19487 ioctl c0306201 200001c0 returned -14 [ 458.065108] binder: 19470:19477 ioctl 40046207 0 returned -16 12:01:10 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x0, 0x0) sendmsg$kcm(r1, &(0x7f00000016c0)={&(0x7f0000000040)=@ethernet={0x6, @local}, 0x80, &(0x7f00000015c0)=[{&(0x7f0000000200)="dd61092ca423656244681b1070b45fd8c63ec19b1674b71be3b0ed551e53fad3ce3be187c8ba8fb3b828ebdbc252894ec499569b07a878670cc129c049fc85c916f97e05dd0dd145583f7c0d81999fb2b638352bc9986f84fd6efa35d56c6851cc11b096b31b749690c44d7b42f3d7d40a9ea31877ba069274c8d9d8856ca60782e028e9639fdb704d2269bace4b93c345a2cf012ce33f5613167d0ed574b4781408fe1823bafc3c893d80ed93a7e189a64527ffa07b9b9c4589c31fb2685b030cb25f54c70561c16853724b7d99de82d4101469c3a7d7d66134806d739a8985b36f3db86d556566dc2fadab81d5c496e4e9", 0xf2}, {&(0x7f00000000c0)="e5aea18bf4f93ef3b1b15d20f10c5c84f1a5bd6a97fe48445e4345333bd03ee05504", 0x22}, {&(0x7f0000000300)="a4ed20bafc180429823d74a6f2f8a4e2465fc2706b7666bfc6dabff77b5aa9e72d40f2eb05e614ee73b28a000fe6ae1526b237912e45548f62c40db6d4dcd32c8b5448d9a78986e620c34912e428d5844439229d6c77777a51253604b0b366c30fc8c485f8cc073b82b6f740a235bb9341a16fcc2e9da5758b182ba46a3d58a2b5782183bdf81bed72e67d4db376b15c9b1e590b0cdc8a1c141c018ca7b58ee9684c742093b7395627fcebf97f15625cceecf34f6b9a0769ea1223566b3ea786570b964c8b26adf19b2fdad62f4daa1b436a4955197b8d48d853d15d4475467203a84653046ee02387b958354308dab2f546525cabf2983aa09b2e1a7b9811ee0e2dd7715986d4e36ff87a1dc98c0ff02edb88a81989a9a0edbbe9570850ca0c28c1e0d4ced092b1d972a79e9506040f7c4f1ff08429d284672c237f244c51a7d087ad84830ba75ebc07e873191845ef3cfb09a7b16dc748813737002ec7d8c3d9638d1c703ab358021ae0c5b869db519ed11b4dd4bd655ed78a5e70a7aef6e4548b9df4954497247b6825fceac27cd5b03611c136743150193b7eedd2b0e4ab91708ac25dd9ed3ab2c7377522387adb64ab404cf49d56dc6f9fb6f18cf4dd3b3454589956ee7a2f524eb2fec6b86111412556290fd1c97cf3c7131a2c4363282919dffece2d838c60fb0ecd9acdb2c75f975027ddabb307232735f4d189919ed2a8aead60b7a5f88e67a08fdbe3eb84398bc6b5f32d96e84c32a051f32ac08f5da175112ecdf9e6595b114fbee47f77b8aa97a56bb3ba2125fb57564020fbfd4d6f01d04ea51adee0ec1ec93c8ee350ef15e6f0c9b747779c9c5ced49bbbbeadc5cb606bfb6974a85f6dd2af9d3a91f229bd3f892d6fa7933c2115b206150099291bd2134e9acd811628a6e5756c41d978c1ccb3aead4f9e9891ff9d9beef082af80fb94abc5a5213634e6216a83429e5b40df739d4533f5fe8cce72888fb89a428303918fbd9d99267df592747871fdca4208736fc6406487df21c3c1f5b168963a913222abf3b627115c790dd9fff468325ebda584a98a86288b68328b61b14d3b7e4df1702da030e21b50934e55f8bc5f71a4867218f0ab2be0ccd836a428fcfd752dca11f32182709cf9f9e4504faa6f78f8cbb15d13a2ab855c405568220fefd9c134bd641db7e319b5e1bd3f143a0ccacc3e6dfba7a0e0699614e7cf17dc7863f769e9ab67016ba257958abe9c56405d08f685784056f4ee67ac3e0d2e00370a2c92588d3ecda61a6622471cc58b181414a076d140534e1afbaa8fd95a54411a0d7e1489001d1fc38121fad2b03339fc1261204dc894b647d2aef6b0d8d72d07e31ed2d565a40ae845004da9a5ac07605f67d59b063f1d787071e2cdbaa7a98b6cccd21df6f6d7adddfb8f40b4c9b24df87547bd977e15ee7777589316fd04583c4c893fc60dfd7aaeefd041bc6541fab8235f3727aba00ada9e66f1ab3e45e4e09c29774ddbcb184c52e94ac68e5f9e723a51d13fa2c41361202c66f1ed9a4c6bc104876cd48f8532377ccb61a7025db48c652f96911720324efbaa599f24d2c6468de6e211b9ee27d4cd3b57c437c7a6d0d87e7e91068ae503ae8088b3a75339d894fb0df16bf0ccaf93b987c78a9db558446adcf4330a1c75e22bf3c5a82cfe665e64e0024fe1d3d9df8edaa8b35db571e59e42d5ebe45f4cd098988ba3a5f78be5d8ad267765d50d30e8ea9616b63542c6760186b9ccfe6a10d6d2b17e1abeea2566a12ee5f2fddcc3bc468c745d2a0a0c70a698e67539ccec11f035c546f9be1a68e3cc544758fab9f6ee57cc77f571807f3e52dc70033ea86a943f78d38a75b0f86d9591327f431054cbed46b954b6dc9e0f2d0d9eda420451d0f11f91c12e3e1808410f3d214b2010df243c47f1e07a9f0d955fe7b7cda92e089d15504f24aa156078ac67b37094f456a900d959485f8e921df276b65e88f63855496591b8d409f0ff2df074d953fe2af83c902efb35b8adb986c8411217c5c967a14bc262cc6222c00de8fbd9a4f655f080645b6c61f605d06bd5f6cb98f76b430cbac79f2d5c9fbe884389ea0b7ceee8d8bcac7cf4363fa204df02130a6ef921a033488dc00533b7912fff3576e661eac582bb25bb65c9ff39d1ad8da61e10979671db4e831c9db65c7797249fac453a31e7b82a0be30daa0436e64fbb82ce1b6faf96c856e623394b117040e84e169bafc83b5010b7278b1e01b46210dafc6578a38636c4d384d6caeb8a6992b92b933f180708dbc5861e3f86a479de471dd37c68947b1030ad0b100ed7880f55835a97dd73ae6bc1b1107377061a6230329c9df16582cf9d6a6d264ec9af994f7497f3cbaff39a03bcc5129f20a14055dbc54498613372a28d2d3eb8ffbded896cdbb565c8279252f339e03037f7740e858ad356bae9535417bfbe83bab3f6f0cba31ab38b900dabed96496d47386a8420964c1285317802279b92d18ea5cc923683bf659b8cf8acf976c1bda5d1516aac0a17c3f9198a9b6809d11dab8d1c70b6c3e54bf3b0dcd5e289aabbc477bd3827f8d029639df2a909750fe94427389628e4c194f25d3e587cdcf6397b9127baff94a65ea260c6c1d61d8e0bde782e675770c2a2ad92b77b6c7b4bf4a8767b82fee0da38c62161cf91ea5588715e70cc9eea5b61ea14fa4e83797b134d7ff29394fc2e12532496c9674252f2ca166f3e2d7955f2b84210ceba77fc0090ddf17a309429b4e9de0b9244bc0233da50c21f7a181d3688dbd28037ed14e67698dbf616822c048a723d02dbafa193a0ccebcab796643c9f1a77e5621a3664e233aa2f561508ac7c5faa0e9b1b96be46ab26958c5d366b1dcaea15bbbe63d3e3a66b95f9e7cf71d857ef2b6cf76fbd875ac7b75b3c7e73205b0f807bd3efd7d9447477b3c37eacdb210d7c946acd2495cfe4ac2100a57ca667d4225b1e4411fc5e8621b7d9180a22c25262101e0ce57ef27789a5c51761846dc680c11fef2b8974963efeedf29de130af4531c8e2e3194812c0bd20c89252d2047f7996114bc83ce14ed80e99e23a310b1d87de9afb6425be092f34b4697263dbce5475541764eaf16b93962cec298d15a5a57563766a23972d0d7fac30cdc5a381b08432a6bdb897dfe2f670a1b1991c7f8b47fbec7e85fe6f40be5f9fa2e643fe235f16a7ae130d2e675587c9cf5eb7d252886900147b832ec759d0a890066356c3adaac76f86f1025ac0f5a7ae806d7742fa776381d12fd861bf4d97a97abae2554d2797b4fb594d422e83295c83af27402a679a8bd045401ace770a4ce8ccfb12ddd8145d005415426d233abe1e6a0bcdedefd2b7c8e0bca5673eb3972b7f4be8d1dba2b6d05d2383bd89107b0ef93e8aa22d9aa895e54d02d429f64ece1691cedc74a76ad6804ac98d4a2c30558b1de4798f656300c31a23a9a38c4f789977fa7e08168c8be0bd9dd59366ca4935b1dbd271229f934248ec5638ca7ee0f87210e17a0bfce5a6860dd7b872523f85357c060cb4052e7536ca4e686ab6bbe7aff8f65b496c6119835b7ec0b2b439bfab408651e0ce1d413aa7cd48300bd02d625a4e88f9de15e5c3b2e11eca86aba8a802c5e1851821967b1a68077e737100956457d0edfc6dc7465a9db3c819e67d868206e0c864a0c600e3a66b1233c4691131869f49de360fab55237af359e6e76806b99c1ecf8395d07288d830f5983425ba31b1c379235edaa474e9070b7646dc43489f52fd8e87b85ff220b97b8a9f75026a7a06ef2d0da910817105175c4abafc9c011a774f82a14b7f09e0840487d62c389b7bb3f9328ae33ba3c65ea1daa995f7637708f4158682b53727c490c9f6c1cafe0aa725d23126dee42a0b1e263a3b03d483540fb653b6d67a1b4466af0edb8d51d4e0f66d5d355420a29bb1d96f7e83e1cf7f1a7a48c81fd8432690080410949db6cbbf88d4d0c4a971bd2185c2e7bdc4f31d7532f3335f11dc903a3d592c457c9f3db00189719b09c9179ff09bdd60445f73fadd17f4ba2d66be5dd4a0d598be9edb61cf2d666b702a70eba6cba99a96a3c55154c6f535dc1af9bd4dbb15b1710ba5c085e091682076b1531f7710219543a498fbc099e21c8271c658ac296ad0445e56dbd9e6e32b8d3d1aa1ef9f7a04f5e7346d2877878bbdede4475d98d4b05e1acb64c50e6ea9b80efe0055b40c0b4344a4b5e7f211ff4af1cdfdb37b61aa2a47661799441bd5a226cdcf5498ef65a6909c72d50550c532e821aff506bfbb3f69d44a7fe100f2aa70cf7483885ae2b4d5b40080f6d8e0701b3539c3ed76aa6e5b5fd8181e6b76928c5c41d3e691b72d5a1e08753b199f1862b59396b461b9b1e8b3fb30dafbd1740c256fa96f38f981cdb2e6cbc7e9f5c074ff3fe98238b9a0b09d7e3886c56ce1a07e09152737897cbc2c9c66fabeab7c0aae5df10a328464b9bb1517b8140062b692655080f736892d3c4ba048a8e693f7c1e883def11f91b16bdf565e4dba2668ff4cdaa30a3334e51467bf7041f56f41a63bd3662eb3d33be6efb24be27ae5a4c55c5e0734e38fe1a09bd74dd6af9f504313ca8775cf7466937f5a5cdb28fab148aa310c1ac4a7a8df1e779b74c5413cc632d1bf12f654c3ae3583668655ec8f22ecac9117ca228eec8595eefaf186bef89590bc13c6a6ae083ef3ccaaaf3f11f5dedfcb40fda36260e65acd55833b335653039ee49c5e432c4f2f442f339a3688efde9a88f51db19f17a217450715dabb243b36b10dea783b002c2ff88c91825e6eae7d740828cb2ad636485f088371a87219a9b4ee553c34f16d3ba430689d806145aecf25a1e9fcae5876c9e0909cf3eb9195fd9664393ec5cd4b5261fe23e85dc5e42340838c8e73c4008ba478843da0227351a91ea6b441ce2ae06c765af861d57dfcc2893490bde4f8280d74a2e280621f7830994067813d4f6e5d50f26fca33ec1cc9741d6264193c796daac119e4c3abdc5f12fe74b8f55ab6f2026bdea5c24bc408dd8930d6bd1ae24433c0d68075715165d4ede3b1840498a2f084bf5e599cb7570b4b53f03115bbe5a10d1fb95a41756b45198a0a3a76a307b9f902aafbf2f48b3cfac5f1548019522bcbe68df68e45c85ef20c0f08a309ff77e54f3eac962965e39e88cc06f50078a7c6cc124c2517e253889332f491cef194efb37c68bb60e2386334aa3c76cabc932e311715a768710e55d53d7944483dfcb5fc9d4aca9f8f54272ffa9da73112e6fd63c1e00eadc40110fab70a996d6d44e68d52c75a0cde553b332b4c7cc66c6714a8e97c0802618c3459a865f8f88ac4171833016946015dc58c17d9d626024522eaf3a9350bbe7adfecb8c256f69fc6aa0df497dddf01443756242937502643b897b21be10fa744c468f312af95d7e9091d3487aa64d1478579caff6aa437f343a879d5df6c3bcdaecabe5d0c3eb6a6e9a740b565061d042427f195af4be434703bd46a0ef9495edb204957ead5f5e15ea8832f0e5868473b77a1fdf39490ae608adffab06cc013fbdd7c98b1a44f9a9da59bed8d22cb44b46efe004a250a34eb32c71b4d47bf3554b263fe5bba64f32c0e1fb19e9c76329d7d8744be5b5e08a7da37c40bd87a079f274c1a8633d2a5355c024f5406c69f3bf7310f6991f0defd68a6fc8c48521a9a3ca056e0ad3f09e785fe883b3da44b78d2a21f3fe98917b7f2a9d90effba4a8c9b59533c4814362d80b0e7cc858f3b0953b0b94e0b6f24044a3077f976fda80889144f1", 0x1000}, {&(0x7f0000000140)="14c2a6d2018b388dbd5824deb3aad0a7adb897f440fdafe11bf06b70a6db8052a630ddc65f298d0492012d3fac679e977c0de7aec81c4290b88dd1d4c5ca14e400325fe202e17c6d28fa1ed544a2f19b6c7df2e0470743d563afcfbb6869695156dbed46cb2177", 0x67}, {&(0x7f0000001300)="c0e9254a7454caa46ffed52f867d4debea964a341df0337963eba1fd884b9fb5616e407add620d9aa04adf756fb684eac863a5eadc34357e686cded71cc18805b3e412b0edba96157983757365a4f226eebd2de5b36d09269c1526d6e80c54f44692711ad405d4b0e9ba5e0bc4c0a20a65bf6677dd64f04454d74688e53d", 0x7e}, {&(0x7f0000001380)="8f0945f3f01a9ff60bf859086a025c06e4a26bb5045a157018a74d7dc38eb23c59115860aeb2a259675328a3fcd357de846d3c56111831e8ae89a1138c3add6e08d207ffd381556a71171a113b025d8d53ae166308385b56648cb93185051bd06549c72f506d7b531ef3fc55c9b4b82c48ce", 0x72}, {&(0x7f0000001400)="2d40c66c87941cbb2cff5fc565abe99d8cde794b3c8edd516d626391ac11b4e2ef3eb0c64e3600c8bfcc05458a087765f3f0bf03da359276fda34bdf1b9fd9f34d96cc902f66fae36efe09a79deef5c33ce27e1372abd85b7e60ce3efe57a99794f0d45255a228b1ebe207f35f7d890221359750eaa2c93e577b332c4e176906c6", 0x81}, {&(0x7f00000014c0)="a3266f", 0x3}, {&(0x7f0000001500)="7eb1a41c5868e194c19595cd285e308b6a1bf3476f4746dac3ec4b64c2fb29766cfc7ec179a4dae48539dd2d6e266659b7aa64e448fe26118bdd1a2d6d5b8afe79d28206cdd29143ce799d8446bc56f072a1cd544b61ab8c63e739700dc1d13e6822336408a44cdb63d6fcfc94b10e9760c1ff862e4313144e55a9", 0x7b}, {&(0x7f0000001580)="21d996e0f29f49cf39c534076a377638ac97", 0x12}], 0xa, &(0x7f0000001680)=[{0x10, 0x0, 0x8}], 0x10, 0x4008800}, 0x44000) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:10 executing program 4: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhost-vsock\x00', 0x2, 0x0) fallocate(r0, 0x40, 0x101, 0xffffffffffffffff) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, &(0x7f0000000040)) unshare(0x20400) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x20000, 0x0) ioctl$DRM_IOCTL_IRQ_BUSID(r1, 0xc0106403, &(0x7f00000000c0)={0xfe, 0x8000, 0x7, 0x1}) r2 = eventfd(0x800028) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000380)=r2) r3 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc0bc5351, &(0x7f00000001c0)={{0x0, 0x100000000}, 0xfffffffffffffffc, 0x0, 0x0, {0x0, 0x2}}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x4, r2}) ioctl$KVM_GET_REGS(r1, 0x8090ae81, &(0x7f0000000240)) [ 458.113105] binder: undelivered TRANSACTION_ERROR: 29189 12:01:10 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xffb8]}}, 0x1c) 12:01:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000000000000000, &(0x7f0000000480)="bce854e9"}) [ 458.186084] binder: send failed reply for transaction 977 to 19470:19471 [ 458.203552] binder: undelivered TRANSACTION_ERROR: 29189 [ 458.212118] XFS (loop3): Invalid superblock magic number [ 458.295730] binder_transaction: 16 callbacks suppressed [ 458.295740] binder: 19509:19512 got reply transaction with no transaction stack 12:01:10 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9e0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) 12:01:10 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xfffffff5]}}, 0x1c) [ 458.346343] binder: 19509:19512 ioctl c0306201 200001c0 returned -14 [ 458.377902] binder: BINDER_SET_CONTEXT_MGR already set 12:01:10 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:10 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x13e, 0x400000000000) [ 458.403377] binder: 19509:19512 ioctl 40046207 0 returned -16 [ 458.404661] binder: 19509:19529 got reply transaction with no transaction stack [ 458.422102] binder: 19509:19529 ioctl c0306201 200001c0 returned -14 [ 458.431565] binder: release 19509:19512 transaction 982 out, still active 12:01:10 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x3f, 0x111000) ioctl$EVIOCGKEYCODE(r1, 0x80084504, &(0x7f0000000040)=""/12) [ 458.516235] binder: undelivered TRANSACTION_ERROR: 29189 12:01:10 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x200000000000000]}}, 0x1c) 12:01:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x6000000, &(0x7f0000000480)="bce854e9"}) 12:01:10 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x1000000000, 0x0, 0x0, {0x0, 0xe2fa}}) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) 12:01:10 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xd1, 0x400000000000) [ 458.575154] binder: send failed reply for transaction 982, target dead [ 458.644362] XFS (loop3): Invalid superblock magic number [ 458.674462] binder: 19558:19559 got reply transaction with no transaction stack [ 458.717746] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 458.727996] binder: 19558:19559 ioctl c0306201 200001c0 returned -14 [ 458.750434] binder: BINDER_SET_CONTEXT_MGR already set 12:01:10 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1c7, 0x400000000000) [ 458.763148] binder: 19558:19578 got reply transaction with no transaction stack 12:01:10 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x8dffffff00000000]}}, 0x1c) 12:01:10 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x1f, 0x200) setsockopt$inet_tcp_buf(r1, 0x6, 0x0, &(0x7f0000000140)="c46a8e616bbc2ec44f275437cf3a50e3dbd9d9032ab225815e78abdb1fe26c2cd5838a4dcffabeffa251d4f68a5fd1f4c227ec75247887cef89d6446da5c28f892831327c7db49d6e4383ccd42603db37cbb72eec3836bd1a164c5494095b6e16cfd3ccdbbd18786913a63dbfdac0504f5d52ece3dec91ddba630187ebe56569c7dd3b1414f19d59acb82ea15daaf00f5e649fa66be61fcb76f14a07285e730a6b207a79", 0xa4) [ 458.791275] binder: 19558:19559 ioctl 40046207 0 returned -16 [ 458.812669] binder: 19558:19578 ioctl c0306201 200001c0 returned -14 12:01:10 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="786673fd", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x3000000, &(0x7f0000000480)="bce854e9"}) [ 458.876911] binder: undelivered TRANSACTION_ERROR: 29189 [ 458.906084] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:10 executing program 4: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x88001, 0x0) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000002480)) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000280)={'filter\x00', 0xa3, "50e934f05e7534089230569cbee68a3107450d2f3604d6b42385bac17f9c22c0bfe9b382b2dc8766017ea9cc6777654a63b06b250de292dee5ccc22c43c003723bca12656ae5859dcb46b1f828a78b26df81caee190bb16a52437247a0c842bb4e9626ddb7a19025605cf2ac5e11046ea06c98f4e9f3681d528f036586265f1a236e649b84916601296a5c11eed5cfef58c78593263f2ed73d1792b34909c00fcc0db3"}, &(0x7f0000000040)=0xc7) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) sendmmsg(r0, &(0x7f00000023c0)=[{{&(0x7f0000000380)=@generic={0x10, "d9bf2b2910807b78a3f0d8ad5c788975131819412ac6c7580fcd37bb63d792eb767ab6bdab9bad1156a3b72008e89e96eecb54ff76f0f16cb3f1fa76e12aca3d1d82eb5e1e4553d56354a32d9154d6e1a683fcd6a39adf9021c4f7ce258052bf86cf3138c110eaaec1686671afd8006fa7464251aca4ba6c6bcf50219d98"}, 0x80, &(0x7f0000000740)=[{&(0x7f0000000400)="8740b0bb208102e110b310b1b23889b1a974a9c0e0478c3002fbac1fce753345b441006722258e59a76d1c268108c16ff50011f59e7a01b791a5bbd785dd50250aed24500c996d7774413818118ea5b75b", 0x51}, {&(0x7f0000000480)="f56326c270078a7ab03954af531caa4b81bf18163966f5b386ee77ec86d6036f0ac1300487b2e681b73d4a91a5b17907c5c03f2efd74b34905746bf98f050e2d807d99c6067b9a641a52ce7c1ac915ac2dc1d7ab73d077c82f452332e45f08459d21b50756c673cebe6164bd9f069e4e65771e1274f0f99a0349", 0x7a}, {&(0x7f0000000500)="3e1ea4b16003fe725f7dfb73cd9404e471a93cf0e03fd44f4751a58297026174516a68fbeeb260a5bf39d1c6f1c53dc386ab3fa05b969d95ab184e9d13ff445ead346bfec274e0e0c6fc34414150c8174cc592f4d0a501640a8edd766b3319cfe5484674525b92", 0x67}, {&(0x7f0000000580)="a2e143875e91b5bffaa9202cdd3ff7a639815245c88b5450d5bb31a7500a522704da3dd166bbcd58b38c5bcd0c480ed2d12ba961fb3b79fb2b156fd824c7a4b93825ce8f402e41259995e778d195ac134273639c5b961351e5a0baaa33971bc6424c6afb9259aa297d911c022b2c08a404c12c41a34b0921dc32c0e816d94b0d8e5be38e2cf2f32b16f9e635792a5512df", 0x91}, {&(0x7f0000000640)="ccf611167d229638c50aec6de774c2749ebbe7ba9748a238b05aebe8f30e8ce7d52fab38024cbe17fa3726da3c1bfd4ebf0d0ffe7cbf9ea5d3688e5dcfbf9146c4", 0x41}, {&(0x7f00000006c0)="18f292560d7ebf75566b1ffe5d63a40109ce5266a172359cdedac53d266cb22c55b3b8c87426e45c4e63459c6bdbdfd0f607dcb8cd41085c00492885d80a35702c6678714e7bd833810cb1a3cd083b107156be13b7031b03d93c64ee7bdb648e38fb198bd007f52ea1465fee153c3ce11e51a3c88091e4cb", 0x78}], 0x6, &(0x7f00000007c0)=[{0xb0, 0x29, 0x9, "0a7750839920c489a649ba645d7e0e321e74cf34d7d1f22257af43241ee0b8de7232b682553e15db94bff555a29c4ad7227ccffe947dd3d01503f56335d82aebbc2c10d6c91cc07be67d7019dc3d61c43539be35725bdfbc04a3ca143b14e2683f2cf44f0345dc08019e445866c4246a8bcaafef0a813e2f321e16559c9d75a5fc99dc5c1b31234fe6cb5202dd8f11a5cafd785a789fdfca669c8148b36a"}, {0x38, 0x117, 0x100000001, "9715ef1c35f38d18bc788adfe565a711bd4647cbe5ba3d5e8c7ad923f20e65495eb6"}, {0xa8, 0x1ff, 0x6, "0bf6027a3da60f34cb9ff47d004f451a8d2d06c7a1f78209a01aefda96d2a40c7978bdfb85825571ad36f8dc2386ac7ec844d03b003ae0e44075dd021d8a05eb658c14fb9a8f1f8f265e3c709bd30f14a359dd2507f6b179aec426810588aefe9f11170ebb216a12746e9fc6360823620d13fe56288ff91d51fb806940534a2db91c11facf55b996e8945c51000182dd577115aecc"}], 0x190}, 0x7f}, {{&(0x7f0000000980)=@ipx={0x4, 0x8001, 0x3f, "106a22264a2d", 0x8}, 0x80, &(0x7f0000000cc0)=[{&(0x7f0000000a00)="0673ef45f7e1cf2473c7d6afb76a5fce3b147d864d56199155a383acc3eae23f9c9344f8ced0183cdb4dedc53f97b4a5dc3325b521bcc2076a8b8da6ede94a99b438d219fdd7ce67a4de0a94c66eeb91f0946959a67b4775629a6c11291adf2a0a58b39ab9f3f7ab3bd21541d437e436eaa9e5549ccb7c8a322a7a77013923cfd504a04f06ab2ca058558ef1b5359f96b68f3295500b0be6dea2dd625774751073031e3542b340f2cb047ecc1cb0a6ce0decb44e53efda720edbf400849171490aa192533e8deca390bc5b73d1ecda730eb6", 0xd2}, {&(0x7f0000000b00)="5e2cd4c7c906092b85d8d275ffae2158d3eb285e3589404bca2637260a1c404a6062bdd5ffceb714d46cbb1ebe256d178a8005796e8f1be02875d893815a6db511be0d8638fc106decddbbadf719215162912d73bde2b0a113ed281ca595e33d2636dc6045d8b7742fa136e40c6644cb7659607c0f87278249057cbc031f9e6b00b45d7849a9070d20e78b70bbfa05dbef2eb147b3736e015a2a8b99d47a4bb0a8102c9ec8ebd2b95e17c99c92baa39ae4976145708806f2da5c15de3b4eff057bbdb49d6f5c8785db0634a2", 0xcc}, {&(0x7f0000000c00)="d3f71b40b17d965b63a7ba8f9da109e5d639364a92e5f45962ee55b34786a9b0d3d6454b1f44d4d1230b3ef0114f71cd54786dd1e3069a5d905bf2c5d89bcb5a005c7dbcfa260577a4fe94ed75ceddd3294f8564d6225c0b46d37925d737222bfc6bcb7432449e95ed1cf8cfc931bc7c96a7839e5675eff85c3372a292af93543c0bca55f51b944e106e6eba121f0dc7ee9808e84482522a819b241db09cf9a0a35fb15d889b89af8fb27b8f46", 0xad}], 0x3, &(0x7f0000000d00)=[{0xe8, 0x101, 0x8, "3e1c0bf0ac4917803b2528254ff860726cee23a0ee42485bf4808455cb603759e399c71edecd481cc8e5ec7a8b8e2b696d04f4fdc147db5f5dec01ecd21675f03d74114eb1544cd6d3e26192a70422f6706df7c80c0637281a6c7ddb1e8fc07642d2c5e8513bc2d9cde4711da827c89146253f5d2dda467b506078759abcd50a47db13f4b29e77798019c62772f7509330f2a8550b301b660c425c5ed8885dec190f08f093041f866941506855ee78bbeda287118c86751bd6ded950274523265f6603705b85fa09824a145ab2e8c1e536a781"}, {0x38, 0x10f, 0x2, "c0d3e841e3bac040669bd9c1671ecec39ef5a8d34b28cddd4300051d875c57539d83fc6e"}, {0x98, 0x118, 0xfba, "c0014817af8d4a1aff283e49ab61225f664c4f289c1ab91093aaec22f442387b014a470cb56cb4c10a6f53a445325343025a0aa4e80064051352b9bd681174fa99bff5ba30156d4fc04c8b315baa3baf1142ddfbdeb2c311e22657ccb4314e8c901aa0cd6c99629dec6beafa833a087ae027a810c1d217d0742b13b2a6e9fea0afb0665cb94f43"}, {0x110, 0x29, 0x7, "7c2b9a649555e6b80313814cf3d9f534eb05a6a9adaafa79da58bcb4d4355daf506710a1e90dbb3c5a4b6121fe1e24f8682f654f7853e229d97376532e1af410791dd7fc7f1c244c16bc3025dbb82473c9be68d5b6b2979469b5203d97897ad909716fcdaa834af8d9afcc7a4fcbfbec41ba7ccb37cb0be852ed9bad54b53bbce3f474eba95f219e570bf3943ec7f6706fd5bb0a3abc2881fe2cb3d567769462fc9d6f64bc526654646a21b12de1bc02d3b5d59aea372ef1930b1896f1d4f04dcdd7db01aadd5e85d0fb71b356aaa39b217e31009ccdf50b6dd7a7dc217f9285e574b368ec4a66abbab450d7750fc833e34e2c9c0e821af230d2"}], 0x2c8, 0x8094}}, {{&(0x7f0000001000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x0, 0x1, 0x4, 0x0, {0xa, 0x4e24, 0xffffffffffffffff, @mcast2, 0xffffffff}}}, 0x80, &(0x7f0000002340)=[{&(0x7f0000001080)="2bf159a25a8c3d7aa11244a3a90f80518b4d40b322fe8c84b441815fe3ce70c64ab6b61ad3f770a6ed78f395f714f6df3609bf14b08da6ca77101f13a0217f3c935106", 0x43}, {&(0x7f0000001100)="b007079efda11a9bf5449b758150c1ec85b23becb64358169fc4fbfc8e1cd8ed1bf335393258a570ba8c8a2fa9556a87a80e84345985d024", 0x38}, {&(0x7f0000001140)="f47509a20958e2b45bb14f16ef8b8ef5f85ead0f441d15790a09e871a6cd1b55dd89b65afa9c1e59fb93d02c8069d4a00c711b0d589609c853cb8eeef2149d72872d45e98f7f251373983387a7558d19ba64db13a93141", 0x57}, {&(0x7f00000011c0)="e8cde97744f0b33e4439ea3431769ef9d04bfb4305f49cd1283ea3c068d9f63d4de9a84d2315e75d2dca5c52c295398aa96a0cc5c886dc964cd88e4272fd9b8f703d0ea5d537445053346f", 0x4b}, {&(0x7f0000001240)="e82d86068d7b1ac0c3910fd787cba6049cc95ba598fe049b72630b75d18bc4ee6f794f79ef9ad31ebc2b79682867cbfb17171a79171b1269e78b3e81e6c73ed6aeb575ab2ecd515c8f66443d1685a46d0f43a4c7731a3dd683095921e4d7740a717514029b5c3bf33f4762a5505e0d1e713fa5c30299eaaf934f69a0a383e40be97adfa47be08a44d6dcb56a2f6113b2bcf73040913dbb3bf570dc3cbe8677c5ca26816488dd4ccc641b395d808154166141700f885232eb9e8b604dc700dce49e2ec919ce854439fb2015ec150bb4c3fc846d83b3e88e6ba05686781519d0300dda8b7986b6d03d08172f45dffbccc209ca78cde1b8306d16650e217055a0aca38b7d09ce3b463155266ed4349603cf2f925a5e711f7a007d173a4d055948032add60e8f59615ec9e2a0eb84f6824a0e872295af233c5c5775e8506a5a208dd40bac12afa68a65faa9bae3d0d6b7c7f580e99431cf4170812aa393badbd721c61a43ab8be5250479697b9e6c7af4e852984153682d8ef8cf9311c9b555765ab1b135a40b847346031e410552655bed0c12cd2f64340dc86d2f3b5a28522974ce5159da1fa1dc8ebe54ada63e5cc0aac1f50f6a5d3713441416ebe43b56236afc7b058609a16472a4a4c9aa56adc79e6ee869f6fe7eadb22c2b27b0f883465af57ccb1eeed88889addbb63df0e1ee123fc9bc87e8e2328576b4d01bfc5040f3f5b3c521f226fd2ebd2f179b752b157adf78b596681132cfa6f9a5f5808650da2c8ffdd56a1761416d2a555de0d6e333f4077c6083619acfc49ccf56a0b11fe5d2b91dc361fbbbaa15bc337134918a0a36db0f7cfcfcfa0eab0fdd01d2f73e564acdf1426be37b5db9a2282c10754c10fe6bd4ad3b6c2eec3aaa20d8b728c9dbeff78fd05d055f6abb77399450220537cc3368c715bcbb01cec6f65f71d642c6d8636d801c3959c6ced1730cb282a90a7908add10bb38f44bf53e6cbf3b59d67c22345292010f657389a3130ea1c380a7ef6d735af985c6db7ab3ec3d284ee76260cd2b1a50712eb2ff781caa719be621a7880d422ba9c37e0ab9f7226586e4ac497dff505bdbef8d73a5ab8140191b7080cb4cda71555a7076323e40b82e96f5dcc1a427ecc54c281b84867564bd2909263683913e30e2b46c581e6bf7de9f4019ccf14dbf0656b5147811d466d7d40728a35fbeee4f28d00769e5a868eac5432eeabac60a1501f6101ed204b4334315f7073e8645383733f2d46f881a4f57ebec46a53f6accaf8cedb95a5cf4972c863028d2f038951a6e0a3d793fe80afe9337846086da022a5ab79aad736299e4857c1f79f5f5da9eaf162652de899b47f14bcb439b630c7f8be3ae25346e89de0000386ad56bf19b5fa4a63f6966076f9cba49ae2ca12ee5f8bf8a091293e71fa98f33c36f5b2df801a5b41ba1cc08e8cc364429075ff395a8c9e51dddee703203fc4023d3c28f1d31fb31e861e477c9e320d92be6f1b980a5bd10d7a91d3115857c7b308c11c7e80fda96940fa9c96d80d6d7247119c7cac070d0382d89d9019bdce14a7f70e75ec2031638d6d975162f447ac3822dc03afac180213859c097bdce88503bd9371070907077da6ac1d50b14d55ee0fc594e0ad948b37df64d8e9762b34fdb5917c8f859e324656ef2f458170d5ff1abf23775324250c35788ae6b442f532f567aedda5887b8dce748fe90659145382cabb638d199e859324aaa2dae959efa5e51d02a2df03a98c00c47de79fe3d3a2a619d53d23eeb4189b98432d247ba0af7524bd16825812777c055a5df68348704f799e518d68043cb5cb078571354e540543f8ae635a55836c5ec54374fd324e32703a6d50f408a24641eb8509433256bb894fa58a94e00f805947552a79681fd4079e788f64005aa90eb1408e31a501adc45d57a68f29db36d864a19dc32a55a6075d267ae9778f0f4e697fb905535d88831b12d00c1d967f0b5747e73b03c01265f2bf517e5dc9893cbfc4298669c10df0ebb63f7b3ab5b958ea86353000ee2afccdd716ab78a3c42f91dfb77cc4e41d4c23edf18eab9ad1dccdd55fff55e455770fef92a8c6c0f2a5df698a3178b7164dea80c412102a98935977354d508c60ddebde3874c2e2fed9278064bef75cf45d0a8914c7dd44b874dbbb632ce940c22ac026c1598e4c15b46d1c4595d2962a2a7b00b6ab409de124efb439aafb8f1bfdf22380c6913e215c5ed8ca1253e167f86a84d1478a6919301d901fec0d55351b0548562bce2e817ae23a81616f1aef5411f9ba3980c0e935c215931ea7a44af850ebb9745e10de671828b3cb0f4357791700450107bf0b9d80770277646ee582deec204aade0a7c7531efafffc104e93639c18a268fa60514a1d466097f63da9f7e8b9b253c845c316b8aadd371f64072d0f3a941910053713e97bef9fa0f7ccf84bf0050447945da9a65a53bcf9555c8016e7105f72ee53672cbf68414e5c06eb7f0bfbe17503821984bc3302e1f8f0537a108ecba212346aa86663d9b6707bb03eae10fd55cfaf392eb0961250ff9fc058a24f2802dbfecac620a9189d518da7949f4c4e7538940fd91e2940d09c1ea0c1373a42a202af33eebcadc50a0b3d359e63955026016c5d321bc08b8279e23197a078933a33dbd8e8cdc9d1be948db59f51be66469be0cb435ae162bce84396c4460f07ba6fa3ba9d25f60931c391e667f44da34e00e71289ba44ce2fe835386981005a2e49ff2c8d98630fd027dd1be30028fd11f911a1c84eeb7245ca9af19e67e39d9aa0aa74a47bd532ed16b12da7f8b223186e6ea6cceedf3d183402dfc8580d9b7352fb9580e15e23cf6f480be18544e9d8af9e1780b329394f3f37bd2afa46a1aacdfe184ec4cd212deec6c77a2589229fd1b41412153b47f6f2a459a1bd59bbcf329d74891e167a67c80f7f62f179002aa8bb5854f7a9502edb4c1e7ba6af66e718921b45167ea5b1ae87fce945fa2d318b3a3fa8adb3fac95715b64a5640da18aaed27b06ef5115dad4a18f2e12ec4a8ee90e81e7e906ffbe90f8e7c4aa24c577b7ba504ee46608ebaea67278ae74d3916ce7c84bf79d7712a2e26b7af8eb6cc8e2e873275c7aa034afd7d8e955f3edb992c29adef077dff2439c6c61c80f9e657cb3734e6f68fcd3e1b86ab12b5f47bf1c8d3386f7b289a663dc162a8f0712ea5eee5b934533e22ab12fef012f5fe434aa61a8070dd7e6262c2e42483fe3f4a39f9ab5df14b2f76e9372076dd4e0ef76de4a6b32c0bdc85351bc6021e3ea937c6e59d9001b4dc3fb3eaf049a6c191502cdc43ceecdb0fdfc45816668350ebfe7e0fe817bd38e7bc25c6bb2a7798147a792216c7781960aea202020d6801ac3f75e5d2960c876a7b350744645b53a6a9b7d40bd856814600fd7da2cb32192190a7b95718c7873dc17990a41db8992784fb7b54c32e3f270cad5bab9e61cd995fd84abd39227483e2ae5fbc9a4d0fa4c828eb509302f14a23e57c851e07288962a76214f777b0b6127ce9c9288482c785d7130e821659a36800d4dfccba2a70541fbc56092e78bcec3c4c95c5b04c4e7215c868900e02832657d38c80006d1438326733a2f380bd964f7ea5e44d8110285bdbb1ea497380ea01eac5885a7ad8bfa1d28912986ee8f34662b3beb4415707a67db27c6f4edd104283b348574244e44bb25d251d109a7f27c039abab6d399b8c95909b30f68826f3e2e1b5612932e2788170eb8499475f65798c27969aa17df39a07f7c1547e5d2f8eb8f1be1722d9372c5d29eed0e91e007ce0a4344233da5c000e5ec227b6190d880c4abd2f70301706b06b41d3e0d584aa44f1988f0f148a07f35aed2d3ddaf8549a12db17185fa540abcf98145ee77e0e6f764ccbd178039f808387e7bc9f21fb5613cad0ea33017c17fcd876e85e42780c6ab3f75387228c410582f5e9d70a52f435447708cc909d0ade57b805ce23c56211df3f48bd646c1512aa717fd1c01644c275476767f38300a8d0c930cf058895e84e4ee6da88850ae89db0f94f2107c55caf35600ce68c36f6df9d6178234173c64e55958f9a5642de029b830d321bf4bda9eaa7638537f381e6506d715e1459cef3702090c71f44ace7612e7c6b3b8b9a664fc26863812a19bcad8432481fd85fc35f674fa57afb49f4fea0bd6626d363f52030b1da3417cb97a9d3ebefb8b283e2d199e9623dde2884b27292d786b7acf344ce850a6cae0fe2479862e23cc8f56681b0d023b118f240de254c5510d9a19f7e5c79216ab8481ac5a9362fc6190eace255d5be564f462bff7385b9fe066e284d472bd1dfc5638a06d88836c6ed4134f93f21a7f1300ddf91dbfb4ab8e3694a58a1f02f89538cd36083fcbb993ec9554ccd3e7af21516f2742131a3e5554002bea30686de8e39514aad258bb6cd85a8eda785c55f2c44f952c3c95bafc18433529dd7e6cdf9365eb021c27be7f0423eba13033f47123cf5674a7f5c23acb449cc2fc2735031dd0bc06464df2eea4fdbbd4778e6160d895889cdc6b60b583fa20843a2f20290085a9f6dd87d9fd28ed12ebbcd577acf58b22fc0c7ced16e13ad15c4027ae32962c1cc01e81c63be5e37a4b2b21f02547f5460a4b7f19b3e770c895af7fc80eb07d339fc35b935b50de3c348b8792fc97a6fd0dea6ce3c10c62e2d226cec6ec1811a1cc5083ffeefaefd3761d133c53aa290c7d1c0ecc0d9c8685d48d47253c0c8223e895a09ba2f20251bd0a59fa00ceb748fffa5e811acf99a3f8fdeba92feed9ddad273a9b04009475645c592c7e4012f3b21b7888ffc11fca1ba4822d03d73fd0f10e79ecdc190b37c1002340be0a3a7de91e1d8b0ba7589a61206864feff30636365ff7f20beaf320a6b8478e38df9e051f857ca47b99754bba3e052d0cdd26ca01e11839c196854787de0934e0a293ddacafe4725d7c69888231055afca5b91f912edc28906183ddb69b21bf8000c3f0387d2397fe149e0a1d2643392c111cd892fcc7d9faf1c673d90062e7caeff673e7526c9ca9aa2e247522ec90fb512443bcbe6f70bff3a7c81694aaba9746339cbfac8ee7abe2e3bbcc6c3dd1c51cfa292ac40da5c6404a292d7c858b4601a6477aee6ad35bbeae8195021047f817a11dc62f7bf11049ebf0153e34f9e91aed11609c71b02e78469e8217a5583b7e0807c3587e65d1311b2bd3624952de1d15d8fa6b9072270bf9657c3f8b9798b4043bcb5d8b178a0fb256d49d089b66e2772777ea354d421ea9a6273d96d5c79a1a3b3a9b4c3a2a24872cc18f9d2162063fea935d90d9be04f9231f7eac027b4f52c5a01897e4b48c267c8bc1782797f21d038efd4278dcda3db39039eb539c8bd1285507ac1dd7d9d1d572f34c40c2849adaaf48f82019acfa0a26cb1302f0257f645c64f23f1b7ad8d9f1dc9dbbe9ad80f50b8b8fdd846d196bca8177c41d69124584cc004d35d387a67deb7e9241297d9ee12c5f3c2cc2c9a51129fd6083193b928d34142fd14f81e73a1e31d9c267f87fc4846b8cc73e771e5cf19cf67b0337b219908b515f1bafa86fc5ecdffacc35e9d8a019582e399e540045b60a1af04baf22f415cfa25c17da1b0bef88730d4403e1b36f3811244f42258f3ff788f4cd59ab119a75568974ef7bb9f57ad6f6c53be2b32b485c26d64164f46fcaa56f0550d2221b527a71710925437a8ca6231de4b788d9525a4e2248730201581a9e38535386ef5e63d00ad46be7c824232a80e0bdd1bc17b74d159c137810592de", 0x1000}, {&(0x7f0000002240)="bc782c9c69ee481e8200ff3a594031c1430d74fbb74f35b1af7279a6192cd1213e7a4203f183ac006fc40f7d4e1594ac2a8540e51c3ed94ccb1149aa36e02009bb9064a3de346a2b57411c840899d22f4e9c0cdca0f74071a26af2d3ae6aba53e23f52b707ef68da307ac344cbeaff75ea878274442d77c149da7b1fce4f550ade655ef986852cbd085d10c1bb147c68d9dc7618e50edbcdc2b43e7a0142b1a335db47f81fd1454705a89291266062de61cd1b8fdad2806f7110230e8eefe888451190c896742a9a3be473dd", 0xcc}], 0x6, 0x0, 0x0, 0x8800}, 0x2}], 0x3, 0x40) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000140)={{0xfffffffff443cf7b, 0x2}, 'port1\x00', 0x0, 0x46b9047901264ac3, 0x0, 0x6, 0x7, 0x6, 0xcd1, 0x0, 0x1, 0x7}) [ 458.980739] binder: 19594:19595 got reply transaction with no transaction stack [ 459.007185] binder: 19594:19595 ioctl c0306201 200001c0 returned -14 12:01:11 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1cf, 0x400000000000) [ 459.039183] binder: BINDER_SET_CONTEXT_MGR already set [ 459.076448] binder: 19594:19605 got reply transaction with no transaction stack 12:01:11 executing program 0: r0 = socket$inet6(0xa, 0x5, 0xfffffffffffffffc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e21, 0xffffffffffffffff, @remote, 0x101}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000280)=ANY=[@ANYBLOB="6f00000000000000923ff05bf3eb71c6be3a2057739d644732a48e688637abffa8b42d685df1031f0000a4cc29197565d7123b99f33dd1f6043d569ab2ebca3de082a5df42a21a045b9fe261ac3a88fb6ee068eb0c3f990514801fc70e6df72ff073f64bf1e2077b1291448c6f655d734a3e0d0e1132236fd4757896f63112b3dc8962f4972a0b93176b3450b763c7e44dd903913e4ed93a402e3eb0d25a136f10a062fba2c80000000000"], 0x8) r1 = fcntl$dupfd(r0, 0x0, r0) sendto$unix(r1, &(0x7f0000000000)="34e92c90d93f49f38973ab733b04eeaa82dc1f769dd57952277d6dbc7b8420394d72ed69f3b9e974a72c7a77a066ff8a7912ddf3d860de239c81508de749019f6cb18fb163e4707ccb", 0x49, 0x80, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) sendto(r0, &(0x7f0000000140)="38929f257c1bf45556635f5cf2714a96ceeaa8b25be3d2df0bea1b42a6cf9c1042ef3a1aa188bc6e975902650b4820152c0147d6d3350421b42d009fbdf01d3777c6c6246334e8f772c083036f41401af2484d41310a7e56e67b73c82dba3f16371eecd900cdf7a5061b8a7336cef2e92f6a828f34954dca41ad6f4670a064aecea73bfb71e46d2aa448177ab37ffc6d52129b590785cf1b1250c6900786818fa12cd18889ab54198253dde3b698ae925d76d5e74e5b26ace27fe8b49ae4db958ffbffffca117c32108427afd5d89c1456", 0xd1, 0x40080, &(0x7f0000000340)=@nfc={0x27, 0x0, 0x1, 0x7}, 0x80) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:11 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x281400]}}, 0x1c) [ 459.124480] binder: 19594:19595 ioctl 40046207 0 returned -16 [ 459.151359] binder: 19594:19605 ioctl c0306201 200001c0 returned -14 [ 459.158368] binder: undelivered TRANSACTION_ERROR: 29189 12:01:11 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:11 executing program 4: r0 = dup(0xffffffffffffffff) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f00000002c0)={{0xff, @loopback, 0x4e20, 0x4, 'lblc\x00', 0x21, 0x1, 0x78}, {@remote, 0x4e24, 0x3, 0xf61, 0x6, 0xb34b}}, 0x44) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000000)={{0x0, 0x3, 0xfffffffffffffffb, 0x1, 0xffffffffffff0001}, 0x8, 0x8000}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1c, &(0x7f0000000140)=""/189, &(0x7f0000000280)=0xbd) 12:01:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x500, &(0x7f0000000480)="bce854e9"}) 12:01:11 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000040)=@fragment={0x0, 0x0, 0x5, 0x3, 0x0, 0x6, 0x64}, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000000), 0x4) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r1, 0x80dc5521, &(0x7f0000000140)=""/244) [ 459.262556] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:11 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1e, 0x400000000000) 12:01:11 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x4002000000000000]}}, 0x1c) 12:01:11 executing program 4: r0 = accept(0xffffffffffffffff, &(0x7f0000007700)=@in={0x2, 0x0, @dev}, &(0x7f0000007780)=0x80) connect$nfc_llcp(r0, &(0x7f00000077c0)={0x27, 0x0, 0x2, 0x5, 0x7, 0x81, "d4012a0aaf6a9c6ed177d4781e870b5f67c2dd366dd7b1faf83574065f8f4c2e8079646fdb27a48becb6f87b82507524e7a3b3ffcfb4dd21393ca5aeab476b", 0x3e}, 0x60) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) recvmmsg(0xffffffffffffff9c, &(0x7f0000007540)=[{{&(0x7f0000000000)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000140)=""/27, 0x1b}, {&(0x7f0000000180)=""/16, 0x10}, {&(0x7f0000000280)=""/124, 0x7c}, {&(0x7f0000000300)=""/81, 0x51}], 0x4, &(0x7f0000000380)=""/62, 0x3e, 0x100000000}, 0x8}, {{&(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000000440)=""/4096, 0x1000}, {&(0x7f0000001440)=""/213, 0xd5}, {&(0x7f0000001540)=""/205, 0xcd}, {&(0x7f0000001640)=""/208, 0xd0}, {&(0x7f0000001740)=""/141, 0x8d}, {&(0x7f0000001800)=""/218, 0xda}, {&(0x7f0000001900)=""/97, 0x61}, {&(0x7f0000001980)=""/47, 0x2f}, {&(0x7f00000019c0)=""/4096, 0x1000}], 0x9, &(0x7f0000002a80)=""/166, 0xa6, 0x81}, 0xfff}, {{&(0x7f0000002b40)=@ipx, 0x80, &(0x7f0000004d80)=[{&(0x7f0000002bc0)=""/4096, 0x1000}, {&(0x7f0000003bc0)=""/97, 0x61}, {&(0x7f0000003c40)=""/101, 0x65}, {&(0x7f0000003cc0)=""/182, 0xb6}, {&(0x7f0000003d80)=""/4096, 0x1000}], 0x5, &(0x7f0000004e00)=""/30, 0x1e, 0x1ff}, 0x9}, {{&(0x7f0000004e40)=@nfc, 0x80, &(0x7f0000005fc0)=[{&(0x7f0000004ec0)=""/237, 0xed}, {&(0x7f0000004fc0)=""/4096, 0x1000}], 0x2, &(0x7f0000006000)=""/234, 0xea, 0x80000001}}, {{0x0, 0x0, &(0x7f00000074c0)=[{&(0x7f0000006100)=""/209, 0xd1}, {&(0x7f0000006200)=""/223, 0xdf}, {&(0x7f0000006300)=""/4096, 0x1000}, {&(0x7f0000007300)=""/72, 0x48}, {&(0x7f0000007380)=""/179, 0xb3}, {&(0x7f0000007440)=""/77, 0x4d}], 0x6, 0x0, 0x0, 0x1}, 0x3ff}], 0x5, 0x10060, 0x0) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000007680), &(0x7f00000076c0)=0x4) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) [ 459.408337] XFS (loop3): Invalid superblock magic number [ 459.567222] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 459.599375] binder: 19662:19667 got reply transaction with no transaction stack 12:01:11 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x12a, 0x400000000000) 12:01:11 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 459.636609] binder_alloc_mmap_handler: 4 callbacks suppressed [ 459.636624] binder_alloc: binder_alloc_mmap_handler: 19662 20001000-20004000 already mapped failed -16 12:01:11 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000840)={0x0, 0x0}) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000880)=r1) r2 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r2) ioctl$TIOCGWINSZ(r3, 0x5413, &(0x7f0000000800)) r4 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) syz_mount_image$minix(&(0x7f0000000000)='minix\x00', &(0x7f0000000040)='./file0\x00', 0x7fff, 0x9, &(0x7f0000000700)=[{&(0x7f0000000140)="055d41385e9e808cb33b0a77c332a2d3d1fd9723baee18e5120ecae9bf5df251f3e859c6325c17d9380fbd7e2e8e4030e386673751c1da987b3dbdf4fbc238d22c9430a29645b18b8481d8fa93d0198228e7172fd4a2f43cc71509c7f050fe03e7625cb03750f82b72021d1c747432a7051c4c05dc022d19be4c2abd2e4eb6d723ab17da44fc5710a2d1c5f70c", 0x8d, 0x3}, {&(0x7f0000000280)="f9420ae300b12a652bb0a878bbaeeb2c1e3dd560f55f8ad6dbe53c40d2d9646c4a50c25a333557b2b4908bef8533d11af8ed49388934e785356628b6f198416ebabf22fd7a7a82a919adb0a2102f5fbd8a", 0x51, 0x3}, {&(0x7f0000000300)="58575d944bbeefcb700f4e5adf4938e6ce160fd456d615885e90c83dff14f93bd0cc969df347b2b675ad499b673e4b0ff940e2822435f72062b4d8068dcded5ba0d4bfc76136adfb482f432e", 0x4c, 0xffff}, {&(0x7f0000000380)="b45754c4c44cb52cef9e3aa92bb7d5584f7667494581d4b1ee693cdab2639c170af06313df6c0be6df8f1fb499b255364d32da66436d780e1eb03ceb9334aa81", 0x40, 0x3}, {&(0x7f00000003c0)="403e1d52ba1c066d8c11c161c5a53cb2015ef5c18580735aa78a75ff220c03eacbfe510d0b73c2872b508b394bbb6cc1ac3a70dee957125da8015aaed9c351aac10ac533ae821b11128239aecb3f7b0e128421a3248e3e0478bcf74f2edc66166ac08d4189607d65c653e8db9c841438e55af263ea732c5ebe566e5a67dee0c52f5768bff12e7dd1b18c44ed395888fdb206738987ff4d10026223d95b0099ff93", 0xa1, 0x825b}, {&(0x7f0000000480)="fd84ed14ab3c7935c78763e4e13d637112b5b3acb9e57f1a297801a5dd20d37f4c309d358946e82d7467b8bd329a88d505c9d2340fbc652c6e7c86349aae2eab522bc57e1ab0c84e7ca6eba63e901465377e1da588cb9cdfcb2bc31830e884d54674fc69defd331914f3ef3202bcb357a77631c134da5988919e029c41bfb94aa11748caffd4c6425e0a77aaea8801c28943e7dec4ca57e5531cff1779f50737b006dd0ff6ecc7f48165593e", 0xac, 0x2}, {&(0x7f0000000540)="1edfd87c2d9ecc293e94690ef19138c066c89525b8f232d83914b280061972e409987031ce4927b4fe3823c2b9aa293814fa860a1c507d1e030582a63cda839012319a8ca9f0b0b63ea943d0de997efd", 0x50, 0x8ebc}, {&(0x7f00000005c0)="e190d2e7853eead989d18d251cafa3d008d381601093f6f1cb4d31384c577bf2a8320f156d9d498281b9f90b05ac05e451fd824e6439735acb5f6c51ffaa6992cf91602a31524c080c68223c6d4dddeb8b5d947aacdbeae25d728927aa04cd883d499a922928587d37dd44ccc848827923fc9d294ae2af9d17333af43b19a63122cc290e222fa98ef37adc1060aef81c636806f7bc", 0x95, 0xff}, {&(0x7f0000000680)="64fe79a19b9ea81d4e133f821188d2e6507d8b2324e7d5527cd59901ae1126d1c80a6930fd95228b6519a2312cb5b904899febccc285339143094f1a255b855c0092d19b7cfbd4fa1fc0b9b99e6b8e30863e31727c5692a397523db0372fb42efba093ffbbff9468d40757153ac79b868c9e717e14e71f6b99dd3c7445b983da", 0x80, 0x9}], 0x4000, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r4, 0xc0bc5351, &(0x7f0000000080)) 12:01:11 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x8000000]}}, 0x1c) [ 459.681202] binder: BINDER_SET_CONTEXT_MGR already set [ 459.734983] binder: 19662:19667 ioctl 40046207 0 returned -16 12:01:11 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x121, 0x400000000000) [ 459.781715] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 459.796016] binder: 19662:19670 got reply transaction with no transaction stack [ 459.796024] binder_alloc_new_buf_locked: 4 callbacks suppressed [ 459.796038] binder_alloc: 19662: binder_alloc_buf, no vma [ 459.855325] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device loop4. [ 459.880885] binder_thread_release: 2 callbacks suppressed [ 459.880897] binder: release 19662:19667 transaction 997 out, still active [ 459.894110] binder_release_work: 4 callbacks suppressed [ 459.894116] binder: undelivered TRANSACTION_COMPLETE 12:01:11 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xc0fe]}}, 0x1c) 12:01:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x43, &(0x7f0000000480)="bce854e9"}) [ 459.918260] XFS (loop3): Invalid superblock magic number [ 459.937674] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device loop4. [ 459.945378] binder_send_failed_reply: 2 callbacks suppressed [ 459.945386] binder: send failed reply for transaction 997, target dead 12:01:11 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000000)=ANY=[@ANYBLOB="02001ea8a38365e9942e798d7dbefb726a0ef76bcc01c0a1b94cc78dab"], 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) ftruncate(r0, 0x40) socket$inet6(0xa, 0x8080e, 0x8001) 12:01:11 executing program 4: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/anycast6\x00') renameat2(r2, &(0x7f0000000140)='./file0\x00', r1, &(0x7f0000000180)='./file0\x00', 0x4) ioctl$ASHMEM_SET_SIZE(r2, 0x40087703, 0xf88) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f00000002c0)) 12:01:12 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x98, 0x400000000000) 12:01:12 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x1000000000000000]}}, 0x1c) [ 460.054815] binder: 19711:19716 got reply transaction with no transaction stack [ 460.071499] binder_alloc: binder_alloc_mmap_handler: 19711 20001000-20004000 already mapped failed -16 [ 460.116144] binder: BINDER_SET_CONTEXT_MGR already set 12:01:12 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667301", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 460.167024] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 460.203170] binder: 19711:19734 got reply transaction with no transaction stack [ 460.210676] binder: 19711:19716 ioctl 40046207 0 returned -16 12:01:12 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1a2, 0x400000000000) [ 460.210758] binder_alloc: 19711: binder_alloc_buf, no vma 12:01:12 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xf401]}}, 0x1c) 12:01:12 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x84000) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000040)=""/4) [ 460.358880] binder: release 19711:19716 transaction 1002 out, still active [ 460.374746] binder: undelivered TRANSACTION_COMPLETE 12:01:12 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xfc00]}}, 0x1c) 12:01:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x68, &(0x7f0000000480)="bce854e9"}) 12:01:12 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="7866730f", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:12 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x157, 0x400000000000) [ 460.484644] binder: send failed reply for transaction 1002, target dead [ 460.553145] binder_alloc: binder_alloc_mmap_handler: 19764 20001000-20004000 already mapped failed -16 [ 460.556399] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 460.625182] binder: BINDER_SET_CONTEXT_MGR already set [ 460.641708] binder: 19764:19768 ioctl 40046207 0 returned -16 [ 460.665590] binder_alloc: 19764: binder_alloc_buf, no vma [ 460.687331] binder: release 19764:19768 transaction 1007 out, still active [ 460.699208] binder: undelivered TRANSACTION_COMPLETE 12:01:12 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x80, 0x0) tee(r0, r0, 0x7, 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000040)={0x0, 0x7f}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000140)=ANY=[@ANYRES32=r2, @ANYBLOB="52ac0600f8ff39003f3767ffc996856463964b98f181990d9a9761d6fa548333d44f5c654663a9fb65b60493dbbb82b1a811cd029b136e1985bcda844387b1bbd8cf16718ab00fa75e4825a5b7cd27b6e7b70ad3857409000000344cecab10925d8a0ad743096042bfed98134ca53f00000000000000000000"], 0x14) fcntl$dupfd(r1, 0x0, r1) 12:01:12 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo\x00') getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000040)={'NETMAP\x00'}, &(0x7f0000000140)=0x1e) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$selinux_attr(r0, &(0x7f0000000180)='system_u:object_r:systemd_tmpfiles_exec_t:s0\x00', 0x2d) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) 12:01:12 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1a3, 0x400000000000) 12:01:12 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x16]}}, 0x1c) 12:01:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x4800000000000000, &(0x7f0000000480)="bce854e9"}) 12:01:12 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 460.785298] binder: send failed reply for transaction 1007, target dead [ 460.887641] binder: 19797:19804 ioctl c0306201 200001c0 returned -14 12:01:12 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xb8ff000000000000]}}, 0x1c) 12:01:12 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000000)=0x0) tkill(r1, 0x41) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) 12:01:12 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xd5, 0x400000000000) [ 460.933335] binder_alloc: binder_alloc_mmap_handler: 19797 20001000-20004000 already mapped failed -16 [ 460.944064] XFS (loop3): Invalid superblock magic number [ 460.965211] binder: BINDER_SET_CONTEXT_MGR already set [ 460.977017] binder_alloc: 19797: binder_alloc_buf, no vma [ 461.011880] binder: 19797:19804 ioctl 40046207 0 returned -16 [ 461.021574] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:13 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x11e, 0x400000000000) [ 461.054739] binder: release 19797:19804 transaction 1012 out, still active [ 461.061955] binder: undelivered TRANSACTION_COMPLETE 12:01:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x500000000000000, &(0x7f0000000480)="bce854e9"}) 12:01:13 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xf5ffffff]}}, 0x1c) [ 461.177033] binder: send failed reply for transaction 1012, target dead [ 461.233676] binder: 19846:19849 ioctl c0306201 200001c0 returned -14 [ 461.259598] binder_alloc: binder_alloc_mmap_handler: 19846 20001000-20004000 already mapped failed -16 [ 461.304082] binder: BINDER_SET_CONTEXT_MGR already set 12:01:13 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667305", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:13 executing program 4: r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {0x0, 0x2}}) ioctl$RTC_IRQP_SET(r0, 0x4008700c, 0x3a9) 12:01:13 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=ANY=[@ANYBLOB="02000408000000"], 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:13 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x156, 0x400000000000) 12:01:13 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x42bb0500]}}, 0x1c) 12:01:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x6c00000000000000, &(0x7f0000000480)="bce854e9"}) [ 461.326403] binder: 19846:19849 ioctl 40046207 0 returned -16 [ 461.335148] binder_alloc: 19846: binder_alloc_buf, no vma [ 461.351221] binder: 19846:19856 ioctl c0306201 200001c0 returned -14 [ 461.359801] binder: release 19846:19849 transaction 1016 out, still active [ 461.368135] binder: undelivered TRANSACTION_COMPLETE [ 461.454725] binder: send failed reply for transaction 1016, target dead [ 461.473789] binder: 19869:19876 ioctl c0306201 200001c0 returned -14 12:01:13 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x10a, 0x400000000000) 12:01:13 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xe000000]}}, 0x1c) [ 461.511949] binder_alloc: binder_alloc_mmap_handler: 19869 20001000-20004000 already mapped failed -16 12:01:13 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x4058534c, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x9, 0x80000000, 0x800}) [ 461.557196] binder: BINDER_SET_CONTEXT_MGR already set [ 461.584650] binder: 19869:19876 ioctl 40046207 0 returned -16 12:01:13 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x3, 0x400000000000) 12:01:13 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 461.625478] binder_alloc: 19869: binder_alloc_buf, no vma [ 461.658495] binder: 19869:19880 ioctl c0306201 200001c0 returned -14 12:01:13 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x500]}}, 0x1c) [ 461.684739] binder: release 19869:19876 transaction 1021 out, still active [ 461.692321] binder_transaction: 29 callbacks suppressed [ 461.692339] binder: 19869:19876 transaction failed 29189/-3, size 0-0 line 2973 [ 461.705019] binder: undelivered TRANSACTION_COMPLETE 12:01:13 executing program 4: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) dup2(r1, r0) [ 461.754629] binder: send failed reply for transaction 1021, target dead 12:01:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x4c000000, &(0x7f0000000480)="bce854e9"}) [ 461.890612] binder: 19921:19923 transaction failed 29201/-71, size 0-0 line 2741 [ 461.905052] binder: 19921:19923 ioctl c0306201 200001c0 returned -14 [ 461.913546] binder_alloc: binder_alloc_mmap_handler: 19921 20001000-20004000 already mapped failed -16 [ 461.926591] binder: BINDER_SET_CONTEXT_MGR already set [ 461.941532] XFS (loop3): Invalid superblock magic number [ 461.955471] binder: 19921:19923 ioctl 40046207 0 returned -16 [ 461.955515] binder: 19921:19930 transaction failed 29201/-71, size 0-0 line 2741 [ 461.971474] binder: 19921:19930 ioctl c0306201 200001c0 returned -14 [ 461.978789] binder: release 19921:19923 transaction 1026 out, still active [ 461.984335] binder_alloc: 19921: binder_alloc_buf, no vma 12:01:13 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000000)=ANY=[@ANYBLOB="21000486a66b00000257ce489da5aba00d80f53872f3e2d677f58860085a5fc148b8211a58967b758dac08244d0caf5bd7e828eefb805f09eeb8584d818dd539a4b9cd91bb76e88d569cb39dc886182e1bf7275317366e0924f01b17e65a1ba52a092fce8a1d383ce5c4705037eff86ea31f6f1b5e2fae8f2dee0446272544c0256ef9928f543e841d4c2d485b2e7fbdf91db8cac6074db830e292fee7ed92c946b4792be80cb8ea605709ff2f63a852aaaef52a2711624a5ca8548780ef5db818339d350c767890260d476860d58562f076996644e4102867550d36579bd7d5d76251b6f60d794fc4f3d3bf9aa27499889f9198a108bf"], 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) ioctl$KVM_S390_UCAS_MAP(r1, 0x4018ae50, &(0x7f0000000180)={0x4, 0x2, 0x4}) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:13 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x135, 0x400000000000) 12:01:13 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xea9655ed00000000]}}, 0x1c) [ 461.986957] binder: undelivered TRANSACTION_COMPLETE [ 461.999405] binder: 19921:19925 transaction failed 29189/-3, size 0-0 line 2973 12:01:14 executing program 4: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000040)={0x0, 0x9}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000180)={r3, 0x20, "3f493d4ec601715ce43859a744099820dbca5499b34f7e186a7409b053a63811"}, &(0x7f00000001c0)=0x28) 12:01:14 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xec, 0x400000000000) 12:01:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x3, &(0x7f0000000480)="bce854e9"}) [ 462.084869] binder_release_work: 6 callbacks suppressed [ 462.084877] binder: undelivered TRANSACTION_ERROR: 29189 12:01:14 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xc4ffffff00000000]}}, 0x1c) 12:01:14 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 462.155341] binder: send failed reply for transaction 1026, target dead 12:01:14 executing program 4: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, r0, 0x0, 0xd, &(0x7f00000001c0)='/dev/snd/seq\x00', 0xffffffffffffffff}, 0x30) migrate_pages(r1, 0x5, &(0x7f00000002c0)=0xb6, &(0x7f0000000300)=0x6) r2 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r2, 0xc0bc5351, &(0x7f0000000080)) syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x800) r3 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x32e50523, 0x40000) write$P9_RCLUNK(r3, &(0x7f0000000040)={0x7, 0x79, 0x2}, 0x7) [ 462.213728] binder: 19954:19956 transaction failed 29201/-71, size 0-0 line 2741 [ 462.251230] binder_alloc: binder_alloc_mmap_handler: 19954 20001000-20004000 already mapped failed -16 12:01:14 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1cb, 0x400000000000) [ 462.312503] binder: BINDER_SET_CONTEXT_MGR already set 12:01:14 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x4000000000000000]}}, 0x1c) [ 462.338078] binder: 19954:19956 ioctl 40046207 0 returned -16 [ 462.370636] binder: 19954:19962 transaction failed 29201/-71, size 0-0 line 2741 [ 462.389661] XFS (loop3): Invalid superblock magic number [ 462.410963] binder_alloc: 19954: binder_alloc_buf, no vma [ 462.427677] binder: release 19954:19956 transaction 1031 out, still active [ 462.435585] binder: 19954:19956 transaction failed 29189/-3, size 0-0 line 2973 [ 462.445335] binder: undelivered TRANSACTION_COMPLETE 12:01:14 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) 12:01:14 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:14 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x6]}}, 0x1c) 12:01:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x200000000000000, &(0x7f0000000480)="bce854e9"}) 12:01:14 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1bb, 0x400000000000) [ 462.467021] binder: undelivered TRANSACTION_ERROR: 29201 [ 462.504897] binder: undelivered TRANSACTION_ERROR: 29189 12:01:14 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 462.534942] binder: undelivered TRANSACTION_ERROR: 29201 [ 462.540446] binder: send failed reply for transaction 1031, target dead [ 462.612123] binder: 20004:20005 transaction failed 29201/-71, size 0-0 line 2741 12:01:14 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xa000000]}}, 0x1c) [ 462.681188] binder: 20004:20005 ioctl c0306201 200001c0 returned -14 [ 462.726428] binder_alloc: binder_alloc_mmap_handler: 20004 20001000-20004000 already mapped failed -16 [ 462.749884] net_ratelimit: 6 callbacks suppressed [ 462.749895] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:14 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0xfffffffffffffffb) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) syz_open_procfs$namespace(r1, &(0x7f0000000100)='ns/net\x00') [ 462.772664] binder: BINDER_SET_CONTEXT_MGR already set [ 462.784858] binder: 20004:20027 transaction failed 29201/-71, size 0-0 line 2741 [ 462.814919] binder: 20004:20027 ioctl c0306201 200001c0 returned -14 12:01:14 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x18a, 0x400000000000) [ 462.831515] binder: 20004:20005 ioctl 40046207 0 returned -16 [ 462.837379] binder_alloc: 20004: binder_alloc_buf, no vma [ 462.867039] binder: release 20004:20005 transaction 1036 out, still active [ 462.871042] binder: 20004:20022 transaction failed 29189/-3, size 0-0 line 2973 12:01:14 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x142800]}}, 0x1c) [ 462.877817] binder: undelivered TRANSACTION_COMPLETE 12:01:14 executing program 4: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x721, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000140)='/dev/snd/seq\x00', 0x0, 0x100000000) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r0) [ 462.934896] XFS (loop3): Invalid superblock magic number [ 462.947492] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 462.965453] binder: undelivered TRANSACTION_ERROR: 29189 12:01:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x300000000000000, &(0x7f0000000480)="bce854e9"}) 12:01:14 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xfec00000]}}, 0x1c) [ 463.024747] binder: send failed reply for transaction 1036, target dead [ 463.103542] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 463.134098] binder: 20065:20066 ioctl c0306201 200001c0 returned -14 [ 463.175728] binder_alloc: binder_alloc_mmap_handler: 20065 20001000-20004000 already mapped failed -16 [ 463.200363] binder: BINDER_SET_CONTEXT_MGR already set [ 463.207381] binder: 20065:20066 ioctl 40046207 0 returned -16 [ 463.248818] binder: 20065:20070 ioctl c0306201 200001c0 returned -14 [ 463.259855] binder_alloc: 20065: binder_alloc_buf, no vma [ 463.265776] binder: release 20065:20066 transaction 1041 out, still active [ 463.272839] binder: undelivered TRANSACTION_COMPLETE 12:01:15 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x2000, 0x0) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000040)=0x1, 0x4) 12:01:15 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl(r0, 0x99a, &(0x7f0000000140)="15b098e911741ce7cfafce1cf6551fa8c1185106a1dc39cb7c96bace121812241c0b8f93468769385617d35cfe9ab7358cf705163dbd1c61fe8eb0065b09cffb66d1c6200de88be2f1b37828d53c39e403a1209eb0b54627bbf70a82cf90d8b851061614785bf5c1a6333fb32172979f98bff60c021e8f336d13eb3f2e983dafec01b618161809bce9364dbad8bc92fd32e9c3669d3859504aaa54642e4b101b33e29ecf") perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$TIOCCONS(r2, 0x541d) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)={{0x0, 0x9}, 0x0, 0x0, 0x0, {}, 0x4}) 12:01:15 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x150, 0x400000000000) 12:01:15 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:15 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xdc7f]}}, 0x1c) 12:01:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000, &(0x7f0000000480)="bce854e9"}) [ 463.334946] binder: undelivered TRANSACTION_ERROR: 29189 [ 463.374925] binder: send failed reply for transaction 1041, target dead [ 463.425167] binder_transaction: 15 callbacks suppressed [ 463.425176] binder: 20085:20087 got reply transaction with no transaction stack 12:01:15 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x4002]}}, 0x1c) 12:01:15 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x2, 0x400000000000) 12:01:15 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) socket$bt_hidp(0x1f, 0x3, 0x6) [ 463.475664] binder: 20085:20087 ioctl c0306201 200001c0 returned -14 [ 463.495236] XFS (loop3): Invalid superblock magic number [ 463.535342] binder: BINDER_SET_CONTEXT_MGR already set [ 463.559598] binder: 20085:20108 got reply transaction with no transaction stack 12:01:15 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) shmget(0x0, 0xa000, 0x900, &(0x7f0000ff5000/0xa000)=nil) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) [ 463.601499] binder: 20085:20087 ioctl 40046207 0 returned -16 [ 463.638463] binder: send failed reply for transaction 1046 to 20085:20087 12:01:15 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x57, 0x400000000000) 12:01:15 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x3]}}, 0x1c) [ 463.640332] binder: 20085:20108 ioctl c0306201 200001c0 returned -14 [ 463.660649] binder: undelivered TRANSACTION_ERROR: 29189 [ 463.682188] binder: undelivered TRANSACTION_ERROR: 29189 12:01:15 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0xff, &(0x7f0000000000)="30c75adc9bb5e8a93311efa2fe0eec6a824fa25358775566ac9c3b203bb7a8c012dc720e04052d372df07da47b3ab12813b2821ceeb75127f8a9b9eeedb8b75dddc027584e75ec1c15c4cdbf9215c8920f3964d4a1e41907dde6821bc2e225acfaddd5e4726eeef433c582e10cb91fac4a089941971e24e1ecdc393bc72dcf8abd4e44", 0xfffffe8e) 12:01:15 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2, &(0x7f0000000480)="bce854e9"}) 12:01:15 executing program 4: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) recvmsg(0xffffffffffffff9c, &(0x7f0000000280)={&(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000140)}], 0x1, &(0x7f00000001c0)=""/59, 0x3b}, 0x42) getpeername$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0}, &(0x7f0000000300)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000340)={@local, 0x77, r3}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000140)='/dev/snd/seq\x00') 12:01:15 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x56, 0x400000000000) 12:01:15 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xffffff8d]}}, 0x1c) 12:01:15 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x177, 0x400000000000) [ 463.957872] binder: 20146:20147 got reply transaction with no transaction stack [ 463.995514] binder: BINDER_SET_CONTEXT_MGR already set 12:01:15 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x2000000000000000]}}, 0x1c) [ 464.008480] binder: 20146:20165 got reply transaction with no transaction stack [ 464.037512] binder: 20146:20147 ioctl 40046207 0 returned -16 [ 464.048823] XFS (loop3): Invalid superblock magic number 12:01:16 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x4800) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x8000, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) ioctl$DRM_IOCTL_RES_CTX(r1, 0xc0106426, &(0x7f0000000280)={0x5, &(0x7f00000001c0)=[{}, {}, {}, {}, {}]}) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000400)) accept4$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000380)=0x14, 0x80000) ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0x1000) ioctl$sock_inet_SIOCRTMSG(r1, 0x890d, &(0x7f00000002c0)={0x0, {0x2, 0x4e20, @multicast2}, {0x2, 0x4e22, @local}, {0x2, 0x4e22, @remote}, 0x312, 0x400000, 0x6, 0x4, 0x8, 0x0, 0x15, 0x7}) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000180)={&(0x7f0000000140)='./file0\x00', 0x0, 0x8}, 0x10) 12:01:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0xfffffdfd, &(0x7f0000000480)="bce854e9"}) [ 464.115677] binder: undelivered TRANSACTION_ERROR: 29201 [ 464.130722] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 464.154888] binder: undelivered TRANSACTION_ERROR: 29201 12:01:16 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0xff000000]}}, 0x1c) 12:01:16 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 464.286903] binder: 20190:20191 got reply transaction with no transaction stack [ 464.306746] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 464.308783] binder: 20190:20191 ioctl c0306201 200001c0 returned -14 [ 464.387297] binder: BINDER_SET_CONTEXT_MGR already set [ 464.402922] binder: 20190:20205 got reply transaction with no transaction stack [ 464.411033] binder: 20190:20191 ioctl 40046207 0 returned -16 [ 464.441452] binder: 20190:20205 ioctl c0306201 200001c0 returned -14 [ 464.450764] XFS (loop3): Invalid superblock magic number 12:01:16 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000000)=ANY=[@ANYBLOB="00000400000000004d23b8075a5386f34bc71be4067e3f121b2afbec8284d9b827e487f8d1643b51e78d2aedd72ea0e96346e5256e4a925e47ffdfa57c310116c041708a4a14811c00c848d1312dcaf5a54b7cc7b5c724dc2858fd4b1d3984fa9370c792d13a7cbd9c8704cd6d057ca936dee2a505d179750374cb8baa0115a03077800533b7955f4af67edd097c4e91b1365b7afc2cff522384ee993710e5a5119fbadd4be5eead0df0e52670d3ddc5d5341ec4419ec0edec557b84fa0d2158"], 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:16 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@random={'security.', '/dev/snd/seq\x00'}, &(0x7f0000000140)=""/27, 0x1b) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) getsockopt$inet_mreq(r1, 0x0, 0x24, &(0x7f00000001c0)={@loopback, @multicast1}, &(0x7f0000000280)=0x8) 12:01:16 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xb8ff000000000000]}}, 0x1c) 12:01:16 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x149, 0x400000000000) 12:01:16 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x5, &(0x7f0000000480)="bce854e9"}) 12:01:16 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000140)='/dev/snd/pcmC#D#c\x00', 0xfff, 0x400) ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000280)=""/143) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x300) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) ioctl$KVM_S390_VCPU_FAULT(r0, 0x4008ae52, &(0x7f0000000180)=0xfffffffffffffffe) [ 464.666558] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 464.691534] binder: 20222:20224 got reply transaction with no transaction stack 12:01:16 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x199, 0x400000000000) [ 464.735395] binder_alloc_mmap_handler: 3 callbacks suppressed [ 464.735411] binder_alloc: binder_alloc_mmap_handler: 20222 20001000-20004000 already mapped failed -16 [ 464.773806] binder: BINDER_SET_CONTEXT_MGR already set 12:01:16 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x900000000000000]}}, 0x1c) [ 464.806732] binder: 20222:20244 got reply transaction with no transaction stack [ 464.843821] XFS (loop3): Invalid superblock magic number 12:01:16 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xe63, 0x200081) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000140)={{0x8, 0x1ff}, 0x1, 0x3, 0x7, {0x8be2, 0x6}, 0x7, 0x4}) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) [ 464.851545] binder_alloc_new_buf_locked: 3 callbacks suppressed [ 464.851553] binder_alloc: 20222: binder_alloc_buf, no vma [ 464.873632] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 464.886461] binder: 20222:20224 ioctl 40046207 0 returned -16 12:01:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce849e9"}) 12:01:16 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x50000]}}, 0x1c) [ 465.053715] binder: 20278:20279 got reply transaction with no transaction stack [ 465.066166] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 465.087035] binder_alloc: binder_alloc_mmap_handler: 20278 20001000-20004000 already mapped failed -16 [ 465.117780] binder: BINDER_SET_CONTEXT_MGR already set [ 465.126340] binder: 20278:20279 ioctl 40046207 0 returned -16 [ 465.139203] binder_alloc: 20278: binder_alloc_buf, no vma [ 465.139950] binder: 20278:20285 got reply transaction with no transaction stack [ 465.178170] binder_thread_release: 3 callbacks suppressed [ 465.178193] binder: release 20278:20279 transaction 1066 out, still active [ 465.194028] binder_release_work: 4 callbacks suppressed [ 465.194033] binder: undelivered TRANSACTION_COMPLETE 12:01:17 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) modify_ldt$write(0x1, &(0x7f0000000140)={0x5, 0x0, 0x0, 0x72b, 0x2, 0x3, 0x3ff, 0x8, 0x8, 0x40}, 0x10) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$KVM_SET_XCRS(r2, 0x4188aea7, &(0x7f00000000c0)={0x2, 0x6, [{0x2648, 0x0, 0x9c4}, {0x3, 0x0, 0x3}]}) keyctl$get_security(0x11, r1, &(0x7f0000000200)=""/246, 0xf6) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000180)) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:17 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xe1, 0x400000000000) 12:01:17 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667303", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:17 executing program 4: ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000040)=0x0) r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4080}, r0, 0x0, 0xffffffffffffffff, 0x2) r2 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r2, 0xc0bc5351, &(0x7f0000000080)) ioctl$VT_RELDISP(r2, 0x5605) r3 = fcntl$dupfd(r1, 0x0, r1) ioctl$VT_RESIZE(r3, 0x5609, &(0x7f0000000000)={0x3, 0x1, 0x8001}) 12:01:17 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x5400]}}, 0x1c) 12:01:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce818e9"}) [ 465.294344] binder_alloc: binder_alloc_mmap_handler: 20289 20001000-20004000 already mapped failed -16 [ 465.303621] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 465.314968] binder_send_failed_reply: 3 callbacks suppressed [ 465.314975] binder: send failed reply for transaction 1066, target dead 12:01:17 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$bt_hidp(0x1f, 0x3, 0x6) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x101402, 0x0) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x80, {0x52c, 0x753, 0x7f, 0x7, 0x36a, 0xfffffffffffffff8}, 0x3, 0x33bf}, 0xe) [ 465.349221] binder: BINDER_SET_CONTEXT_MGR already set [ 465.368554] binder: 20289:20290 ioctl 40046207 0 returned -16 12:01:17 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x15, 0x400000000000) 12:01:17 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xc0fe]}}, 0x1c) [ 465.392809] binder_alloc: 20289: binder_alloc_buf, no vma [ 465.469449] binder: release 20289:20290 transaction 1071 out, still active [ 465.480742] binder: undelivered TRANSACTION_COMPLETE 12:01:17 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce828e9"}) 12:01:17 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x400, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x434, 0x4) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{0xffffffffffffffff}}) [ 465.584719] binder: send failed reply for transaction 1071, target dead [ 465.679745] binder_alloc: binder_alloc_mmap_handler: 20331 20001000-20004000 already mapped failed -16 [ 465.709802] binder: BINDER_SET_CONTEXT_MGR already set [ 465.717021] binder: release 20331:20332 transaction 1076 out, still active [ 465.724160] binder_alloc: 20331: binder_alloc_buf, no vma [ 465.742478] binder: undelivered TRANSACTION_COMPLETE [ 465.749332] binder: 20331:20332 ioctl 40046207 0 returned -16 12:01:17 executing program 0: r0 = socket$inet6(0xa, 0x20, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:17 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x577390f870]}}, 0x1c) 12:01:17 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x170, 0x400000000000) 12:01:17 executing program 4: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dsp\x00', 0x1000000020c800, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000000140)={0x5, 0x86, 0xa11}) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) 12:01:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce82de9"}) [ 465.785417] binder: send failed reply for transaction 1076, target dead [ 465.794001] XFS (loop3): Invalid superblock magic number 12:01:17 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:17 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x7d011080]}}, 0x1c) [ 465.915844] binder_alloc: binder_alloc_mmap_handler: 20364 20001000-20004000 already mapped failed -16 12:01:17 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) syz_mount_image$ceph(&(0x7f0000000000)='ceph\x00', &(0x7f0000000040)='./file0\x00', 0x3f, 0x5, &(0x7f00000004c0)=[{&(0x7f0000000140)="1c2111d66e2edfac7ad0d2ca4b5289eeab", 0x11, 0x6}, {&(0x7f0000000280)="110e3bc466f1e21a612febd20ba68b32bb98b3802663afd1f5a561ef4e78458114d51c254d80722d8f463d6fbd4cf2dd71c40de0bc22a09d2996f60b65c809e17031c9439ed7e7827ad1cb5ce0bfcb9490cca70bee384a90d19f18c1ca75484c9a14e04d1784ba723edd7f86b9aaecce440e57e16a7a4a8311a8ecf361976e8fd51eeeb113e26bda7008e8433b1dc2c3c1d3e23ca0c2ecfbc32f51e8b7985dce7f272a54cbba2e5e026ebb09725c82946664775d3fa9", 0xb6, 0x3}, {&(0x7f0000000180)="10e471f1070486c1092e1cb77acde359359b4317ba0a40ca860d7e4f9a645ec446def4292a860da9", 0x28, 0x4}, {&(0x7f0000000340)="ca41255a2692ab2be9452af47fcf40f2411fdf2e05f58f1c88efdbc5f3b8df3c49408c9bd86abf712ebaae9f1634011bb92713b31aaccc6818561935fb4aac82707c10fab474f63432115b0cfc94c3b20c136b9399eb7fc26cd55a9d8f851a5072109871a3b57a4b239622d73b99abc926c9c289e3c46eaa98c324f9ec74a39721aba42577d339dadc6426be5772961a40ce2d8218db95ea267c0c3737e0f4995df272d6c47a1c09193152", 0xab, 0xec63}, {&(0x7f0000000400)="f3ce0639d7c408d90bd831d9b7d68c212b8aa579d50d571613f1d37c7bd076948c9d1aa094ede3cbf5ab4e6f8a2772f69a804f0c702856e20b1ceef3ab25c4d36ecf4fd2cf8e66639c5cb6263a38d71d2e81d9ceb44f9f0838e3337ce1da5d15dcaf40084140e3ad775d532352dc49c494ac0072ef5763e9b8d8255134ae2e190380570d213c93d1fe3c92d7f18467009bd576426601e889b1cd1ad4ebf82f82c510b65922782d0d6b32e1ebbfe6636bb5ca15f5c306eccfe27c6867c6", 0xbd, 0x8}], 0x2000, &(0x7f00000001c0)='/dev/snd/seq\x00') 12:01:17 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x95, 0x400000000000) [ 465.961811] binder: BINDER_SET_CONTEXT_MGR already set [ 465.971849] binder: 20364:20372 ioctl 40046207 0 returned -16 [ 465.982524] binder: release 20364:20372 transaction 1081 out, still active [ 465.996076] binder: undelivered TRANSACTION_COMPLETE 12:01:18 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce84be9"}) 12:01:18 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x16]}}, 0x1c) [ 466.118364] binder: send failed reply for transaction 1081, target dead 12:01:18 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x2c, 0x400000000000) [ 466.193598] binder_alloc: binder_alloc_mmap_handler: 20397 20001000-20004000 already mapped failed -16 12:01:18 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x4) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x2) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000100)={{{@in=@broadcast, @in6=@ipv4={[], [], @remote}}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6=@loopback}}, &(0x7f0000000040)=0xe8) 12:01:18 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xa00]}}, 0x1c) [ 466.275334] binder: BINDER_SET_CONTEXT_MGR already set [ 466.298730] binder: 20397:20400 ioctl 40046207 0 returned -16 [ 466.317314] binder_alloc: 20397: binder_alloc_buf, no vma [ 466.339460] binder: release 20397:20400 transaction 1085 out, still active [ 466.350753] binder: undelivered TRANSACTION_COMPLETE 12:01:18 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x82, 0x400000000000) 12:01:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce811e9"}) [ 466.389398] XFS (loop3): Invalid superblock magic number [ 466.412233] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 466.465183] binder: send failed reply for transaction 1085, target dead [ 466.521529] binder_alloc: binder_alloc_mmap_handler: 20440 20001000-20004000 already mapped failed -16 12:01:18 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x8) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000000)) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:18 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) r1 = dup2(r0, r0) write$UHID_DESTROY(r1, &(0x7f0000000000), 0x4) 12:01:18 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x18020000]}}, 0x1c) 12:01:18 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x131, 0x400000000000) 12:01:18 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 466.564962] binder: BINDER_SET_CONTEXT_MGR already set [ 466.581678] binder: 20440:20441 ioctl 40046207 0 returned -16 [ 466.590414] binder_alloc: 20440: binder_alloc_buf, no vma [ 466.596714] binder: release 20440:20441 transaction 1090 out, still active [ 466.607798] binder: undelivered TRANSACTION_COMPLETE 12:01:18 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)='security.capability\x00', &(0x7f0000000180)=@v2={0x2000000, [{0x10001, 0x4}, {0x42}]}, 0x14, 0x1) fcntl$setsig(r0, 0xa, 0x1) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) 12:01:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce845e9"}) [ 466.724703] binder: send failed reply for transaction 1090, target dead 12:01:18 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fc, 0x400000000000) 12:01:18 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x4000000]}}, 0x1c) [ 466.845808] XFS (loop3): Invalid superblock magic number [ 466.854335] binder_transaction: 32 callbacks suppressed [ 466.854352] binder: 20479:20485 transaction failed 29201/-71, size 0-0 line 2741 12:01:18 executing program 4: fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000180)={0x0, 0x0}) r1 = perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140), 0x4}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x1, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r2, 0xc0bc5351, &(0x7f0000000080)) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x101000, 0x0) userfaultfd(0x84f114c4efb7568f) setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r3, 0x3) fcntl$notify(r1, 0x402, 0x10) 12:01:18 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x4000000000000000]}}, 0x1c) 12:01:18 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1ed, 0x400000000000) [ 466.971460] binder_alloc: binder_alloc_mmap_handler: 20479 20001000-20004000 already mapped failed -16 [ 467.013317] binder_alloc: 20479: binder_alloc_buf, no vma [ 467.023718] binder: 20479:20507 transaction failed 29201/-71, size 0-0 line 2741 [ 467.041640] binder: BINDER_SET_CONTEXT_MGR already set [ 467.048216] binder: 20479:20502 transaction failed 29189/-3, size 0-0 line 2973 [ 467.064809] binder: 20479:20485 ioctl 40046207 0 returned -16 [ 467.079432] binder: release 20479:20485 transaction 1095 out, still active [ 467.092894] binder: undelivered TRANSACTION_COMPLETE [ 467.174842] binder_release_work: 20 callbacks suppressed [ 467.174849] binder: undelivered TRANSACTION_ERROR: 29201 [ 467.197341] binder: undelivered TRANSACTION_ERROR: 29189 [ 467.244968] binder: undelivered TRANSACTION_ERROR: 29201 [ 467.250469] binder: send failed reply for transaction 1095, target dead 12:01:19 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=ANY=[@ANYBLOB="0000040000000008"], 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x14, &(0x7f0000000040)="7ac84b332c81d15a0613fe7c", 0xffc7) 12:01:19 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667306", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:19 executing program 4: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000740)=ANY=[@ANYBLOB="7f454c460820017c03000000000000000300060001000000970300000000000040000000000000006000000000000000010000000400380001008000040003000600000005000000ae2d000000000000ff0080000000000000000000000000000900000000000000010000000000000009000000000000000600006000000100020000000000000005000000000000000300000000000000010000800000000001000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000eb000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000160000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a432b817"], 0x4b0) r1 = msgget$private(0x0, 0x10) fstat(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000280)={{{@in=@broadcast, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6}}, &(0x7f0000000380)=0xe8) getresgid(&(0x7f00000003c0), &(0x7f0000000400)=0x0, &(0x7f0000000440)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000480)={0x0}, &(0x7f00000004c0)=0xc) r7 = fcntl$getown(r0, 0x9) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000500)={{0xffffffff80000001, r2, r3, r4, r5, 0xa}, 0x0, 0x7, 0x7, 0x10000, 0x40, 0x6, r6, r7}) r8 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x10002) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r8, 0xc0bc5351, &(0x7f0000000080)) r9 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000580)='/dev/sequencer2\x00', 0x12dc80, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffff9c, 0x84, 0x66, &(0x7f00000005c0)={0x0, 0x8}, &(0x7f0000000600)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r9, 0x84, 0xa, &(0x7f0000000640)={0x31, 0xc47e, 0x1, 0xffffffff, 0x8, 0x8, 0xa0, 0x1ff, r10}, &(0x7f0000000680)=0x20) 12:01:19 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x800000000000000]}}, 0x1c) 12:01:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce81de9"}) 12:01:19 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x69, 0x400000000000) [ 467.415870] binder: 20522:20523 transaction failed 29201/-71, size 0-0 line 2741 12:01:19 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x96, 0x400000000000) 12:01:19 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) [ 467.480408] binder_alloc: binder_alloc_mmap_handler: 20522 20001000-20004000 already mapped failed -16 [ 467.518277] binder: BINDER_SET_CONTEXT_MGR already set [ 467.523716] binder: 20522:20523 ioctl 40046207 0 returned -16 12:01:19 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x5400000000000000]}}, 0x1c) 12:01:19 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 467.586044] binder_alloc: 20522: binder_alloc_buf, no vma [ 467.620252] binder: 20522:20551 transaction failed 29201/-71, size 0-0 line 2741 12:01:19 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x14f, 0x400000000000) [ 467.664129] binder: 20522:20543 transaction failed 29189/-3, size 0-0 line 2973 [ 467.674679] binder: undelivered TRANSACTION_ERROR: 29201 [ 467.680224] binder: send failed reply for transaction 1100 to 20522:20523 12:01:19 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0xffffffff7fffffff) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) [ 467.735682] binder: undelivered TRANSACTION_ERROR: 29189 [ 467.805426] binder: undelivered TRANSACTION_ERROR: 29201 [ 467.810926] binder: undelivered TRANSACTION_COMPLETE [ 467.836083] XFS (loop3): Invalid superblock magic number [ 467.854965] binder: undelivered TRANSACTION_ERROR: 29189 12:01:19 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) capset(&(0x7f0000000040)={0x399f1336, r1}, &(0x7f0000000080)={0x1, 0x10000, 0x0, 0x3, 0xffff, 0xfe3}) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:19 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x10110200]}}, 0x1c) 12:01:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce84ce9"}) 12:01:19 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x10, 0x400000000000) 12:01:19 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:19 executing program 4: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x6, 0x80000) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000200)={0x80000000000000, 0x10001, 0x3, 0x0, 0x3, [{0x5c6, 0x3f, 0x6, 0x0, 0x0, 0x2000}, {0x3, 0x3, 0xfffffffffffffffe, 0x0, 0x0, 0x404}, {0x5, 0xfcf9, 0x5, 0x0, 0x0, 0x389}]}) ioctl$UI_SET_PHYS(r0, 0x4008556c, &(0x7f00000001c0)='syz1\x00') r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000180)) r2 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) r3 = dup2(0xffffffffffffffff, r2) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r3, 0x6, 0x21, &(0x7f0000000000)="f4eb951d3a7d4aeed9a12c1c84cb22dc", 0x10) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x8, 0x62012, r2, 0x0) ioctl$UI_SET_MSCBIT(r3, 0x40045568, 0xd) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r2, 0xc0bc5351, &(0x7f0000000080)) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$EVIOCSKEYCODE(r3, 0x40084504, &(0x7f0000000040)=[0x101, 0x7fff]) [ 467.957552] net_ratelimit: 5 callbacks suppressed [ 467.957562] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 467.957774] binder: 20587:20591 transaction failed 29201/-71, size 0-0 line 2741 12:01:19 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xc4ffffff00000000]}}, 0x1c) 12:01:20 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x173, 0x400000000000) [ 468.028560] binder_alloc: binder_alloc_mmap_handler: 20587 20001000-20004000 already mapped failed -16 [ 468.075531] binder: BINDER_SET_CONTEXT_MGR already set [ 468.129858] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 468.160662] binder: 20587:20591 ioctl 40046207 0 returned -16 12:01:20 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x3, 0x212080) ioctl$SG_GET_SG_TABLESIZE(r1, 0x227f, &(0x7f0000000040)) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) 12:01:20 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x11000000]}}, 0x1c) [ 468.188991] binder_alloc: 20587: binder_alloc_buf, no vma [ 468.225159] binder: 20587:20616 transaction failed 29201/-71, size 0-0 line 2741 [ 468.256332] binder: release 20587:20591 transaction 1105 out, still active [ 468.264125] binder: 20587:20599 transaction failed 29189/-3, size 0-0 line 2973 [ 468.274327] binder: undelivered TRANSACTION_COMPLETE 12:01:20 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fb, 0x400000000000) [ 468.313897] XFS (loop3): Invalid superblock magic number [ 468.333648] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 468.344667] binder: undelivered TRANSACTION_ERROR: 29201 [ 468.350466] binder: send failed reply for transaction 1105, target dead 12:01:20 executing program 4: sysfs$1(0x1, &(0x7f0000000000)='/dev/snd/seq\x00') r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000040)='\\&\x00') [ 468.390304] binder: undelivered TRANSACTION_ERROR: 29189 [ 468.440785] binder: undelivered TRANSACTION_ERROR: 29201 12:01:20 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000140)=ANY=[@ANYBLOB="00107225678ebbfeaa54e4d78f2b3472f0eef53495fd63184ce053b3054da337e64d7e397ca786666f2f2c0f405e736ded15ff2e5d4183eadac7f91ae758974a2db15b70720248c1e57cec64de0d24aa7b127733d0c6c43aaf7168fe70b94df27cfbab31eab67bfabff84fe21beb8990697babac8704127bdca05e2bdc3b6ae190c485ebda4def0e82d8daf0fc7456ea0470cb627f09702a80a8373813c0558b960ac4c801f4c7ce84328e2d91cfc6747cb0e4dbbc16d404557c2e679530bd95327171675c6cd49f"], 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce802e9"}) 12:01:20 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xfe80]}}, 0x1c) 12:01:20 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:20 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xaa, 0x400000000000) 12:01:20 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dsp\x00', 0x1, 0x0) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000400)={0xa0, 0x0, 0x3, {{0x0, 0x2, 0x80000001, 0x1, 0x4, 0x2, {0x0, 0x355, 0x401, 0xffff, 0xddd6, 0x6, 0x7fff, 0xfffffffffffffffd, 0x1, 0x5, 0x5, r2, r3, 0xfffffffffffffff7, 0x5}}, {0x0, 0x6}}}, 0xa0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) r4 = semget(0x1, 0x0, 0x34) r5 = getpgid(0x0) ptrace$peekuser(0x3, r5, 0x1) semctl$IPC_RMID(r4, 0x0, 0x0) r6 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x8000, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f00000004c0)=0x0) ptrace(0x4208, r7) getsockopt$inet_tcp_buf(r6, 0x6, 0x21, &(0x7f0000000140)=""/23, &(0x7f0000000180)=0x17) syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x100, 0x200000) [ 468.640433] binder_transaction: 16 callbacks suppressed [ 468.640443] binder: 20655:20667 got reply transaction with no transaction stack 12:01:20 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x20000000000]}}, 0x1c) [ 468.687599] binder: 20655:20667 transaction failed 29201/-71, size 0-0 line 2741 [ 468.712353] binder: BINDER_SET_CONTEXT_MGR already set [ 468.729031] binder_alloc: 20655: binder_alloc_buf, no vma 12:01:20 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xd9, 0x400000000000) [ 468.729820] binder: 20655:20683 got reply transaction with no transaction stack [ 468.749766] binder: 20655:20667 ioctl 40046207 0 returned -16 [ 468.759894] XFS (loop3): Invalid superblock magic number [ 468.791019] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 468.805539] binder: send failed reply for transaction 1110 to 20655:20667 [ 468.815770] binder: undelivered TRANSACTION_COMPLETE 12:01:20 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x107, 0x400000000000) 12:01:20 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x5000000000000]}}, 0x1c) 12:01:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce835e9"}) 12:01:20 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 468.981023] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 469.033988] binder: 20713:20716 got reply transaction with no transaction stack [ 469.092240] binder: BINDER_SET_CONTEXT_MGR already set [ 469.116466] binder: 20713:20725 got reply transaction with no transaction stack [ 469.126132] binder: release 20713:20716 transaction 1115 out, still active [ 469.133480] binder: 20713:20716 ioctl 40046207 0 returned -16 [ 469.164859] binder: send failed reply for transaction 1115, target dead 12:01:21 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0xfffffffffffffffd, 0x0, @dev}, 0xfffffffffffffd82) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000140)=ANY=[@ANYRES16=r0, @ANYRESHEX=r0, @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYRESHEX=r0, @ANYRESDEC=r0, @ANYRESHEX=r0], @ANYRES32=r0, @ANYRES16=r0, @ANYRES16=r0, @ANYRESHEX=r0, @ANYRES16=r0, @ANYRESDEC=r0, @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYRESDEC=r0, @ANYBLOB="421c62542a4413624622d636fa4024befb763eeda6d031c8e2e4f454f533f7a900398a0131f496ad5a04c249a7f53735e38d3099827bc21f95147745ebbc28afa331adc1bdff3889de7306b6372acf52e46dbec86426ee93312487c3dd4d264ea21bf0c284acafb586965c7276f1636fd26c775643a2e96bcada22f6d4f170aec0ed3cfb450ca44a848089931a59e54f7672813ebca89bc3cfb50c9811a8a832b636a193296c027b6055292fd0e4c2d2c12a6b9b89a072251524d1ab311263eebdce9e6c3c86d1a65744f79b1e1b39ec5ac38b9e1272865aba711d5b6d95c83379a6ec38d2b4e6ce8ea36a36dc43d10d14d009d4064721a7896473b9559e0807774a98d583f839f314e79d2ae2144041e11f1bece95f33d7f1e2702d56aefda3e7929ef895a5e998bcb1f374b25fd141b700175d2b2c21099b1641232d01675c9d71492e43d65f9aaec148ea36d9b25c44a095c50d9e52ec8e2b173d9d84a808cf8cf425379452fdd49098f4b1f24d55abe49fdb9d4ca5ca9ddf2ea6a0284cb4e1d5b5383cc08f4d4ad7fecc72e768a37e86b276aab675a2ba3dce7b0f160516392dee7cfdb4f87edeba3e9c018d5355b9ba481c6fc9cb2e579bbf0bbf956aaeac0f19791d627a62218a7abbafa1dec66ec63fc9ede4be0aba1799823128e002ed4f8b5a224500b3ec893891d81e7aa4f08f7bf08d4fe34e64be61ff694eb4396a80a4a96e401be6b40d95642f3e89f4a2f5506c5db0c73845be0d9355abc521eda90cef2bd8bab05e9675553992526e4cb7d579f252fddc8e194f2424cdbc47f9a2a71a806f6a9d5ca38f1c67adfd291ed8633b8533e4a37aa1e8915ded37f578a7f4c00a2101990f6561117ec143a37f0d7a9af5695c35e2c8e58d27a99c4d8e36e5d0cf33f900ce5f28d59bd75d3041116e37b3fee02561c21de9899a970bd52c477076e33f5315c1f406a6df69ea84f8f553a2ec482aa3667e1bea27dbf671a97dcdc81e7f51c4b30e36fc23043d1b24655d1c06ce453c44804fac20509eb3abc284d5912e428b43aab4dc177756756e8d4703be08cf69f8214a3a815030da9122a45d90ca43a48ded32e42b207663d51c2e49e065310a85b8c777932d46c241618cf22f571e7d3c592bae8f971fe579471f61b13374227bf2e3ea01c6cb1539efa82ed9208b80f8502b67f5dbd1180377ae62a216f302d05ce4ba6fb47473b7aee734be27f98a17cbcba69d2e19159493dd1f3df9f27c8092b8c07b652a361d050f40de0119e6d63d97edf9ea534da69310fcf13d95160f8256d70234faa18a40b20e13998ee7aaac53c33cf7dbab6af2550ec9d0ce7f2cff918b4ee83976791d2de7f5ea1cba3c5a2f0e377d87da10841a196ee81c30f259ae5e49d7e512d05ca11dac54181d3b11f33714c3cf2566226c3b4a33e97f59bfbacbe12db18363eb8bfcfb3de78aa79423d78dd709ea22ae926e28be22df6498adc74ed9cd857c4f3a91c44287bb8540686956599c0d010a4e70b039113617bf8b538e92856f70d36a6462651ffe5a0dca0164a6b65b90297cf81127844ae1f8b9791c2e4552bdace5ee7d88ca0197358b2343645769c3230b97fbf76db897ab21776cbe1cc22184beb6daee5789f1d5cc4b12eab1e20c97f8623dbb903335fa6165a941e4f6f4c1147f678e9938a52be903d42c52d205c6c6e6f2b7132fcf3c0940fb317083a02afc771062e034e13e7d53cef26846f1131396442acce4a0ca82d8aa840bbdbfe1544e136eb67c59c8f485bc7919f7800710a0fdd1b5db3a259a8dce2098fb6dd698507b9e49ab7460659a35cbb2aa78b78d774525e14d09c37e4bb28348b367f076b0ee7a83d5ed9a95d1cb8bf4f1ead96b415f097fcc3cd5ec88b9f40d47cf86e0df9ff2c455e1cb9ba2cbe407f4fcb8d6286d32ce1720a4474c529480487e34870dc255cb123814dce49a92921b6fecf6c654af9350ba5fad1f518a2798ca50163aef1a74a912c359b10f8ca4950a40e670ea4f10d27bd5c0ce11deffead1b5c5d182c93b8983616257417b59e76da223b6965a916a948ae659b8489f0a80ecfa840eec412bfb9be2a66f144604177e4a397002de60c69afef9b8f928864c0154f2975e11a22138b77cc3fed2b250cfde458ba885c6feaf9ff7bab61ba338331524398cb860878de8d684aacc02edc2e56221491d75aa06ebb4836e422bc7a59e836161e01da839d2b6c83a5e59388209e5990bab762f9cf9dfa9b19dc54d8cf717957726badd2f0c004c881a73693cc12b1389721e149c977cd07d686bdf87b5d26554bd75ac437bd5235c7fa3f610a3b0cbe43530abe5db2abe67180e6aa97dba09dc6b189022c80378ee9829a319c0c67400508c699d17e84394fb146874a549d5094d6ae046d72574c8398f144eadd7f907131d813cdb7f8686ce17935390a13e615b289f20ae2abd0fb2632e8c84f57b7ba4d9d61d124f658bd76889d6352427c88cd03693e511e36adb351d456392ad2891479d829d61bea7f4c773654f45d325e02bf1e8b374230d89206afe1908db4dbc889c91cee308f52d6c2cea3af5c4017dffb32759b9a6ebb5333fdb3be3ad2e4681e72b127c3bd4f81d3a8cd11c545087043e2421b559c2a91ecc5e2df5e94b5361df78bdda20e4848749028c3cc95c34e77f7a36cc488327e0226dfffaf846a2c6392a8e2e596c0fe6946dc1912a4eba22ca41b7a7b6b35802e8d6eadcc489a8a7ee7cab81f8863567af83f960b9395532580540e2cc4a88f8cd3f9c127ba3216d0e279329b9f510b7c49c5b6f2dc51a4b315e21751118a23d038919e550d2b116884c3f00b5e4a87db344c7730ff025b79c30ce21db0920e1a96f461f73389b08a6f761f7f0e255adeae317e65be8b114a800dadedc188e6169961be5a0659074b5d8416bbdc3170a0d648327f41c78b8237f373df84efa45eb7624aaf7a3624499b22111b3cf71013593cdd341bfd067b99ea7d57b0d8649ed19d15dc5d91685b3de1cdc6c7466e151e2826682a2abdaefc84e4284ede7724a2e64ad86e7d1dfed6a2eba3a8aaeef85c1f0605bd8634a000be15668b7c648699d525a9dd6c4eabfc32060585478a68fe0ee7f54eb4385d7fa7df80a12fa9ea371ae0ce92b586aceef82106035b66780821102673919cdb08afdb785399806c8674c275462f5c5310c89dfdd29260ce6804422c1bbeb41395050b8ee4d0d4b97740a3c74607c8e55b31812b5d71e89564eb81c29c1a27b4f7d1cd5c029716afc97bb10ed6f053351847f6065aa2f21b4fa385a47fc8d30956403ff7a6f274597925afea399f64fd635ce9cc9cfb6831b219b4b73847399d77fc4047c8e058f4798257afbd3066eea5700667c6fd4f9ae3d5ea583a504086e66523fe9f695d0e06bea5db33f2a486bbdac5737b259145c842429af03e685074624d5a5efbeeecac1a49e8fa15a4b7612871c2a61d501d43abaa7aa24da030fe078792301724505bcd6d8cba74c23fe94d59edd8e9943a130ad78681e13d7e405bbca938715d9d47f7c0a48090052f83fb8562395202c7389f977760f85c006e9b33f93362c0fe3d15d08ab6963d9bee4d1483e23b5bdcf90d4c475ca92d5949596e55d3dcfebc8f36134bf4a2eb0a3e2a7d6cad0e135065807e8d607ba369172fa917807e832abcedf892cf812157cd464b8e423eddb895e0569efc850927fa557aaa6eab15ff362410f840e8c1a903877b4e6d23bef735e7e8163ade8af6ec436dc7e0ad13e90c923ff0a131abae0afd20f030101a2356393df7a2cf74dc7a3fba5a531f7458b802f1bcc11487f382858d7a517f1f3819794e65d600913e91de80329b1aac21aa6987f80c0aa8ee12bbde5ed8ae3c4278723587a76823cec4dd75a8bc401e47205de345f3afd004113bff65542769b9ac5e0d8e2ac54005dd996210eeadd89cac6e4964d3afa448327490c930bddbcefd150b1f3efef3ad43bdddc5b38c2582e7e9cbeefcd3461c416a6f61a13a54f6ddaf5c96dd817df3ba0992c0f63d7aa9d537f5b4bcbcdec431a52d8ba9f14ceb3eff1a04417394b66cd8c5205f26f844f949a7aca6c57a54698b70c81c47307aeab7e6ad02689db97ad0e38de573c38862e6f6cf069e03934ee249b87ad2c8538c9236afb9843af1ee3af4d7e2a4698348f623679707ccd839640c4755cb5136626cca2a040aa20fffc2cd566aaa7388ca71290ba63cef46ae9846472feab58ff794c1b2585c918f4336ba6db835bc33012e5d797a4beedf999a40e0de5d95d68962e8d3745c0044766e965e61330405c3f636f7a3df8ca13e5f5c082e3ebb2c4856d8fbb283e0925fca06d0e0550e279c6a91c594013edcfa9daba6af57c6389dcf705dc02a5186780e13a7d30ec7acfeae43ed36d2b101ff3f7bdc22f904b3396cbf56bd08cd4d5f759e50ee7aef79f10f79c0aa8f0f8303715cb76baaf3f14245810445d41eb3bdc7e144a50af3cfb10e03eb5ffd72dbe3e83d808c08d43908d164574aba071ab2e7f9ca36fe0d754185250620eaec084839c93706b06d0f73af951feca03fc72db40e6ae26bca876a83650b02c5a3a5877b112a7a2991a970b28763da2133db8a1c6026f433c3b222378572e4040a9c8c7426ea7dc259026c3f25f048ff28691f53e4940052b64de97b2fa9e80c5f82c9f3d8e7dd707b2d8f126c0cf8350e1e8fbe81f722da606595c04ed5065b61f34e2e18ef7f2ca786a9d1e2492db7c003aa604667f6bd9ef696710563fda03e72c2776377cf4cb873fafc2c7eb276e88e9b51505a79fb95a11182d183065140ffb1f04edf1eca39ec9f0c2eb8cf9e3c4330d1371043913debdb0e248dd78bf0602e1d39828f0a01d16f0d94e17cddf12cd576b923ce06a2a9610e961114197e48bfe063a3bb83e93c745b997679c59148d11d6a285dfef556491b5c3be557049942ae7c2ab222e6a54f41206773a08f1e767af8f6ae3da2048067818df1edb472bdd3d4eaf9bc97404468d74ef72f05f8d7714c199ee745a1f88fa6bd0805d761cd1b9b3a6f518918bab39533b48a0c5f55974a43924109459eb81e0249e78bbcb6c5f5a1d1d85a67fa5782a73197dab529f89bd1252b5fa8a4f74b6c851c87699deb5114b59c9418698f4489c00de4a4d158c5c4bad3527c7a21e3c04e3f1816ddf7697e992527ddf7ea7e8406f6e3a0c9c8c12f342ce1d64730c1b2ca0e7b36e0ec87e66819d9cbab4b6bf4b83912686e31b51c8146a6f07fb2facbb42ddfe06c5142dc2cc2b9ec1610654329d156ddbe5e31521eaafdea4bee1c33f5894894ca3dd4c5d341f047abda1f9210041ab26123e32135b5e297a3433c8064e67c6306b3fb850f8266bae5f4becc380908775ab7ae0be90731d8d5796ef829e3274e2290b852d9fbe6b9519daf936d37dd0515db768da629e8e3ac1fce9809583f93ca66b1b46d33ea79f8261bf8337db305c926ece9e5958a8c9f8fca76ab3c34572950e309937e2dcbe7daf7945bbd8596bd728f51676bda7d8399292c861f80be98ba30a34525f0e18ed62eec055c5da7c56fee8c48f98abdae46cf84ef68ea31cee2b8405bdbb39ba83979ff6a9a02259727448ea3f700604cb0bf6994e6abe4dfc1b9845939ca91ecac31ad32acbc6b41bcbbccd7b263cb7ef7a37ba47ad118ddfd2d501c58879ce66aa6ebd231dc8976014e1867013dcb55d057f72e006438dfaab6723b378751a53824a95e561351e9bfe7b98ba23bc7b97c15c2e5b641b857ce5b698fc23", @ANYRESHEX=r0, @ANYRES32=r0, @ANYBLOB="cb90651d51d64575b9f523fd4add984fa61d12fa391f638b08ccf2834dc8732488876b60eb36d6ff20f386ad179a41dd5e7e070e9aee566ceb195a1250bd8656a81e0e920264b8e87ffaa231f52b258bcfeb2f084853128ccedb6827ee645e2fdd2e45e7b9f99ace00000000000000001b054a351850530edf11cba2e143a6ab3dd7bab846882f3960f1bf0400000084c0a1b380f79ff813a7f67899b7d3da5966457bbb634c3d06c7fdc5ab39a62ab3b44f"]], 0xa) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x200900, 0x0) getresuid(&(0x7f0000001540), &(0x7f00000014c0)=0x0, &(0x7f00000001c0)) stat(&(0x7f0000001300)='./file0\x00', &(0x7f0000001340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RGETATTR(r1, &(0x7f00000013c0)={0xa0, 0x19, 0x1, {0x48, {0x10, 0x4, 0x5}, 0x60, r2, r3, 0xe4, 0x7, 0xff, 0x80000000, 0xa7, 0x4, 0x8, 0x1, 0x3f, 0x3, 0x20000, 0x3f, 0xff}}, 0xa0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:21 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xa3, 0x400000000000) 12:01:21 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x70f8907357000000]}}, 0x1c) 12:01:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce809e9"}) [ 469.205803] XFS (loop3): Invalid superblock magic number [ 469.298957] binder: 20734:20742 got reply transaction with no transaction stack [ 469.301153] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:21 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xc4ffffff]}}, 0x1c) [ 469.347544] binder: BINDER_SET_CONTEXT_MGR already set [ 469.366324] binder: 20734:20753 got reply transaction with no transaction stack [ 469.376004] binder: release 20734:20742 transaction 1120 out, still active [ 469.383512] binder: 20734:20742 ioctl 40046207 0 returned -16 [ 469.434785] binder: send failed reply for transaction 1120, target dead 12:01:21 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x5, 0x4000) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1}) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) 12:01:21 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x15e, 0x400000000000) 12:01:21 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f00000000c0)={'yam0\x00', {0x2, 0x4e22, @loopback}}) r1 = dup(r0) getpeername$netlink(r1, &(0x7f0000000000), &(0x7f0000000040)=0xc) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) sendto$inet6(r0, &(0x7f0000000200)="9ea7d89ef783d3099d70857a7980afc730ff4ba8c8bad32a12999d61b69f6cc25489424191081837424a3464d469583a9882c6ef973c6e0010d498b9a63ba7555620d43f93cc29c2a92fa4b3c75073e8fd5f78458b99d860d6cde61fb6de9fd4df3ed0a08fe6365f4d9baa02abb422c16d53d51b3c41f2e20639a75632ba26896c70973f139cd218e8a2a283d1ca3d0b55ad465971a13d017772f9d701c571896dbc7346196efe7b4190d2c22095eacac14fcca67995a3f39a9ed69c37b03d6f770804d315b743bce1547c38", 0xcc, 0x40000, &(0x7f0000000080)={0xa, 0x4e23, 0x1, @remote, 0x3}, 0x1c) 12:01:21 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce824e9"}) 12:01:21 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x500000000000000]}}, 0x1c) [ 469.768453] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 469.775274] binder: 20768:20773 got reply transaction with no transaction stack 12:01:21 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0xb2, 0x400000000000) [ 469.829467] binder_alloc_mmap_handler: 3 callbacks suppressed [ 469.829486] binder_alloc: binder_alloc_mmap_handler: 20768 20001000-20004000 already mapped failed -16 [ 469.848811] binder: BINDER_SET_CONTEXT_MGR already set [ 469.854330] binder: 20768:20773 ioctl 40046207 0 returned -16 12:01:21 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xe803000000000000]}}, 0x1c) 12:01:21 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) r1 = open(&(0x7f0000000000)='./file0\x00', 0x400, 0xa8) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0106426, &(0x7f0000000140)={0x5, &(0x7f0000000040)=[{}, {}, {}, {}, {0x0}]}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r1, 0x4010641c, &(0x7f0000000180)={r2, &(0x7f0000000280)=""/202}) [ 469.894567] binder_alloc_new_buf_locked: 2 callbacks suppressed [ 469.894576] binder_alloc: 20768: binder_alloc_buf, no vma [ 469.916347] XFS (loop3): Invalid superblock magic number [ 469.932258] binder: 20768:20793 got reply transaction with no transaction stack 12:01:21 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x132, 0x400000000000) [ 469.980832] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:22 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xf401]}}, 0x1c) 12:01:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce851e9"}) 12:01:22 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="786673fc", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:22 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x1003e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0xfffffffffffffffe, 0x9, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x400100) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r0, 0xc04c5349, &(0x7f0000000140)={0x7fffffff, 0x9a1, 0x8}) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) ioctl$FICLONERANGE(r2, 0x4020940d, &(0x7f00000001c0)={r1, 0x0, 0x3, 0x7, 0x10000}) [ 470.188668] binder: 20817:20822 got reply transaction with no transaction stack [ 470.232569] binder_alloc: binder_alloc_mmap_handler: 20817 20001000-20004000 already mapped failed -16 [ 470.277069] binder: BINDER_SET_CONTEXT_MGR already set [ 470.300000] binder: 20817:20822 ioctl 40046207 0 returned -16 [ 470.330161] binder_alloc: 20817: binder_alloc_buf, no vma [ 470.331079] binder: 20817:20822 got reply transaction with no transaction stack [ 470.364972] binder_thread_release: 1 callbacks suppressed [ 470.364982] binder: release 20817:20822 transaction 1130 out, still active [ 470.384633] binder_release_work: 3 callbacks suppressed [ 470.384639] binder: undelivered TRANSACTION_COMPLETE 12:01:22 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000000)={0x0, 0xffffffffffffff01}, &(0x7f0000000040)=0xc) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000080)={r1, 0x2}, 0x8) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:22 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x1f4]}}, 0x1c) 12:01:22 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x53, 0x400000000000) 12:01:22 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x80400) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) 12:01:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce844e9"}) 12:01:22 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs ', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 470.484716] binder_send_failed_reply: 1 callbacks suppressed [ 470.484724] binder: send failed reply for transaction 1130, target dead 12:01:22 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x11a, 0x400000000000) 12:01:22 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xffffffc4]}}, 0x1c) [ 470.564999] binder_alloc: binder_alloc_mmap_handler: 20849 20001000-20004000 already mapped failed -16 12:01:22 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f0000000140)) [ 470.633455] binder: BINDER_SET_CONTEXT_MGR already set 12:01:22 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xea9655ed]}}, 0x1c) 12:01:22 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1d4, 0x400000000000) [ 470.683106] binder: 20849:20857 ioctl 40046207 0 returned -16 [ 470.683258] binder_alloc: 20849: binder_alloc_buf, no vma [ 470.716451] binder: send failed reply for transaction 1135 to 20849:20857 12:01:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce823e9"}) [ 470.764682] binder: undelivered TRANSACTION_COMPLETE [ 470.898325] binder_alloc: binder_alloc_mmap_handler: 20892 20001000-20004000 already mapped failed -16 [ 470.926813] binder: BINDER_SET_CONTEXT_MGR already set [ 470.935605] binder: 20892:20893 ioctl 40046207 0 returned -16 12:01:22 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x8800, 0x100) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f00000001c0)={@local, r1}, 0x14) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f0000000000)=ANY=[@ANYBLOB="100d000044572f3b24952ee2a8860c00000000"], 0x8) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r2, 0x29, 0x6, &(0x7f0000000200), 0x0) socketpair(0x8, 0x1, 0x1, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r3, 0x84, 0x7, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r4 = request_key(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz', 0x2}, &(0x7f0000000280)='vcan0\x00', 0xfffffffffffffff9) r5 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$unlink(0x9, r4, r5) 12:01:22 executing program 4: r0 = syz_open_dev$adsp(&(0x7f0000000300)='/dev/adsp#\x00', 0x7f3, 0x100) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000340)='/dev/rtc0\x00', 0x0, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000280)=0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x400, 0x0) perf_event_open(&(0x7f0000000180)={0x5, 0x70, 0x2, 0x1, 0x1, 0x8000, 0x0, 0x10000, 0xe0, 0x1, 0x5, 0x2, 0x800, 0xac12, 0x9, 0x34be, 0xfffffffffffffffb, 0x1ff, 0x3, 0x5, 0x23, 0x9, 0xfffffffffffffff9, 0x648, 0x2, 0x3, 0x5, 0x9, 0xc3, 0x3fb, 0x9, 0xfffffffffffffff9, 0x4, 0xffffffffffffffff, 0x3, 0x9, 0x4, 0x5, 0x0, 0x6, 0x0, @perf_bp={&(0x7f0000000140), 0x5}, 0x20, 0x162400000000000, 0x0, 0x6, 0x9, 0x7}, r2, 0x10, r3, 0x1) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0xf, 0x7, 0x0, &(0x7f0000000840)) recvmsg(r0, &(0x7f0000000740)={&(0x7f0000000480)=@sco, 0x80, &(0x7f0000000600)=[{&(0x7f0000000500)=""/224, 0xe0}], 0x1, &(0x7f0000000640)=""/197, 0xc5, 0x5}, 0x40010003) clock_gettime(0x0, &(0x7f00000008c0)) futimesat(r3, &(0x7f0000000400)='./file0\x00', &(0x7f0000000900)={{0x77359400}, {0x77359400}}) r4 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000380), &(0x7f00000003c0)=0x4) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000780)={0x7, {{0xa, 0x4e22, 0x4, @mcast1, 0xe3bc}}}, 0x88) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r4, 0xc0bc5351, &(0x7f0000000080)) r5 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x5, 0x400043) ioctl$sock_inet_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000040)) 12:01:22 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:22 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x5000000]}}, 0x1c) [ 470.946898] binder_alloc: 20892: binder_alloc_buf, no vma [ 470.961348] binder: release 20892:20893 transaction 1140 out, still active [ 470.971277] binder: undelivered TRANSACTION_COMPLETE 12:01:22 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x19f, 0x400000000000) [ 471.016401] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce81ae9"}) 12:01:23 executing program 4: socketpair$inet6(0xa, 0x0, 0x65, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$packet(0xffffffffffffff9c, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0}, &(0x7f00000001c0)=0xc) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000280)={{{@in=@multicast1, @in=@loopback, 0x4e23, 0x4, 0x4e22, 0x1ff, 0xa, 0xa0, 0x80, 0x32, r1, r3}, {0x100, 0x8, 0x401, 0x3, 0x5, 0x3f, 0x0, 0x80}, {0x0, 0x5, 0x0, 0xfffffffffffffffd}, 0xffffffff, 0x6e6bb3, 0x2, 0x0, 0x3}, {{@in6, 0x4d2, 0xff}, 0x2, @in=@broadcast, 0x3507, 0x0, 0x3, 0xffff, 0x2, 0x5d, 0x5}}, 0xe8) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r4, 0xc0bc5351, &(0x7f0000000080)) ptrace$cont(0x3f, r2, 0x40000000000, 0x1000) [ 471.109473] binder: send failed reply for transaction 1140, target dead 12:01:23 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x4002]}}, 0x1c) [ 471.182524] binder_alloc: binder_alloc_mmap_handler: 20924 20001000-20004000 already mapped failed -16 [ 471.204849] binder: BINDER_SET_CONTEXT_MGR already set [ 471.213498] binder_alloc: 20924: binder_alloc_buf, no vma 12:01:23 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x12f, 0x400000000000) [ 471.235857] XFS (loop3): Invalid superblock magic number [ 471.248495] binder: 20924:20925 ioctl 40046207 0 returned -16 [ 471.283522] binder: release 20924:20925 transaction 1145 out, still active [ 471.295616] binder: undelivered TRANSACTION_COMPLETE 12:01:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce82be9"}) 12:01:23 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x21110]}}, 0x1c) 12:01:23 executing program 4: r0 = epoll_create(0x9) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f00000001c0)) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhci\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='vegas\x00', 0x6) write$vnet(r1, &(0x7f00000003c0)={0x1, {&(0x7f0000000280)=""/133, 0x85, &(0x7f0000000340)=""/109, 0x3, 0x3}}, 0x68) r2 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r2, 0xc0bc5351, &(0x7f0000000080)) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r2, 0xc058534f, &(0x7f0000000000)={{0xab8, 0x10000}, 0x1, 0x6, 0x6, {0x8, 0x200}, 0x37, 0xfffffffffffffff0}) [ 471.395007] binder: send failed reply for transaction 1145, target dead [ 471.439684] binder_alloc: binder_alloc_mmap_handler: 20956 20001000-20004000 already mapped failed -16 [ 471.485142] binder: BINDER_SET_CONTEXT_MGR already set 12:01:23 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000080)={r1, 0xfffffffffffffff8}, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:23 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x9b, 0x400000000000) 12:01:23 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="786673a0", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:23 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x8b376316]}}, 0x1c) [ 471.524984] binder: 20956:20960 ioctl 40046207 0 returned -16 [ 471.569787] binder: send failed reply for transaction 1149 to 20956:20960 12:01:23 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x8000, 0x4000) sendmsg$nl_netfilter(r0, &(0x7f0000001600)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1100001}, 0xc, &(0x7f00000015c0)={&(0x7f0000000280)={0x1338, 0x0, 0xb159cf9967104e3f, 0x400, 0x70bd26, 0x25dfdbff, {0xc, 0x0, 0x9}, [@nested={0x1c8, 0x59, [@generic="4e1bc5a6cedafcc3dad981a5813c0fdc09967bd76034b5c583d4546b4d528bc6a98d36838d186e38e5a105b61a3549", @generic="25a2a99747905cb0306a05de86e082b8ae6d21b53ac110458e94f8c237245f0926685e580449661846f14f0d4e0d6680335db0f93b4cb5762825f8e96df7981e1073bb613b11d6195da90e4a67060d981d8d8ccb884103e8f04de6529fef39f06d3e1150934b730b75e6bdca74e22c6b1249ae7e00567a82c170b812d7b04e0baa03d6ff3a6cadea35dd4cca94712957dc2e7779cfbdeb0e1663b776fc8afc2edd7b32414d2c6f4b5a650cbf44cb67ec4522eefaafc4e85d3f28d7304d9101e162d532cdbd652b8bbcb0e5a594cbeed8acc09b81a07ccf76bc1c811eb24bb1bff8119ce43f1935cd98bad5e662440dce1aa98a48c883", @typed={0x8, 0x20, @ipv4=@multicast1}, @typed={0x4, 0x48}, @typed={0x8, 0x3d, @u32=0x6}, @generic="66853ef73a1fa253f95063dca2e0", @typed={0x8, 0x70, @uid=r1}, @generic="600489e38a77c844761328a3a6409d1a2e24a6b2ea55c39a2ec76a55ff6355356dc14a5724c27639af5b8a0a74c63ea45e583198f0ccf3de26efd5f621195bf5145643240b5e2b91a8af33ac054135193947fc46f3363e30f77aeed1d26dfa00905c1f6d7cc2d85520dba93849d6b7a963de2d06"]}, @nested={0x1148, 0x69, [@generic=')', @typed={0xc, 0x8b, @u64=0x9}, @typed={0x4, 0x16}, @typed={0x14, 0x8a, @ipv6=@mcast1}, @generic="b5bed9f35367a6332612c599c6761e9c274341d7ead2503db6bec0112367fe9f", @generic="69c5b89106587abc7fe7e34f080792c6165d9504469e7dd470ec4902ce1d7595c6e2ba325cd5", @generic="e54821d44c27b77b620f4a3e055bdd13526fe1bc91dcae7eec7ac1b28f508d17ae4cd28e82608847465334646e49e2e17a6544c60efbb1af94bf3b4c482adadc70e35a64964b1aba54d29c219055f7f9f35b3c7ef41e", @generic="4d4422a5518a8c928942a2eb7f617b6a5b1122b5f4df1246b1ec58b5ffa8ebcba40fdac4267b14e066e2ec63eb3b31c7058fb67e1c406796e7c260fa2fb88148801bcc9d507fe19921f53ade64fc70ff0885875496eee569272bea577a9eb2e24da21f82dea4c8631f49c2ef72a9e80ab71e1c30b00ef47741a85fe953b28c314fdf0f828226ac574555f94f1c1684a9ed90c254e97c9de2bc161cc56dbd51d30e7ba9db696bad1cade4836f9a450c82fe3b500e2120054ff7e40613665c84141ce431a14a68ac2dfbf9298415bd2e72fbf064224909a65f4419695771c953dd9ef9f257b3b6f5dbf9f25a6fedfff3befa457a43824a7c306a34bd41382c838257c81bf50d2c907b7b3753a99eb76bafc051cd0630c852d1089d6a4691c0ff96987fb7d59f49a2ac757857adb563fe2138655932e8e8f24d8fc16cf6d8b27ad6265ec14e6fe93346bcd698571b4813765cd75ef0a9afab7342d029e6e3a63289385082cd48cc2c1660a219bc29e899b272aac28dffa07c1d83fbf3fa384961916e954b23a7d8b6a687a78ca45f264dea33794c63f809fdf41224647b3d5aae511d6b75622da8a0f2cdd9240d8d1a2da729fce8244cf05c8064cd9941498e997329326162d4bae67b6d930c4a553d4656655a9bef625c8b142c9b5258ab7e83e7030149dfdec9f08aaf4d20fb1d8827e9e1e5976f2c23a33fddc810d004b3e1adf0561be989d930c5523e81e5f8b48e92cd96cd77d3217fff5d38c82f571ca4e67073e11d9348779fa3971fcbcfd80752cbfced01b780c308f03b86525f65f7be5d85ad840cc459d6a8f457b81193064d7347ee164669dc8f833acbb6b356a760bb7f7caf7a354135b5e5bba8485f108d9b5b0577ac5a13de02b858196514b33dc24d6ee8091380e2006f5fde366a106721241468630e6e9d69e8a1bb5ce16ece06ff169de3daa31fea4c02c877ae5ab7d7a4c00b501211c81db7309fac3ffc7b4a497fc7c814537cca27bd0ceb3298509145621270c9322724cc7d60fde16f963675dc1d150eb3d16a26ea6f6e30287177c555325b7cabada0cc128eb96e5b36648bc000dbd94050236138aa151036dfe941653d098e2827aa5952e7417dc8ab77fe3817df804f7bf987bddded868e9fd6d5952a273aa7bcb90dee919422b6a64bbe53a1b7ad5bbdfb4baa73525324f103d7c830ce89f5c40a663590e494155e158e3dfc43d6e458c6d6e4696e1e0567b28885ac78cd074ad21f2b4c6947f6a80c5330a4c04f07885659650d7d6336eca31b7f56d1fb6110a46c663890b04037c5e273835296552b74013fbd037058cba565f0c04c8e4de5ef1333e66faa389307597208d87d28716a3774598745f26f250dd77e674432d678bd21f6554dc306e6dd690aea276fb9cfb171dc864acca20f82d8d4261303c5f6cea128c91d8245dced2783dafc6e7886c5d9a0a8e71585324caf0cf13859a51ebda38238af835f114aa43af8ef0a95bab6a3a72588d42d0512ee9a746b947c164bdf685c706e92a11fb473f418c45709d9080c19bc0b988be22d80c45bec39850b1cae27340015481fc05209ff4f47028b4b2e447327e2f5e306111dc2d642908e063c86120476da94a619f4f06daae2f2ebfb257099c2a5fa54e8258458f8c3ddabc57374229371519f8c1b2ad20a04fc2577cb97fdb47eb3f8b9ed2f25d86640b8f214abd1134a21156af58ec303caabbc7b467f37d3ee0cd01f63eb5b2b29c250d96e3b83b4bd94f6e092e8263246d79c576066b5e42afa46cd1859c5d9a1716dcebef518d3a12620bbafc932ed12f89619d724d459ea9df97896ecc48b30b76486e0a46260ceb213782144b423ccdbc98fb4d1ff14a5745c15042a162f623716a089941e0aa2e13003a9273dfea201ba4e9985e1e658f7520ff09fc564231c68c27a74f26f234ce3095905ac109bbdb632bf5e13ea56ae5cc9e03126f9a055738dab0d1e9ee12dfbe5916d3dcfc94e6cf3c215b2db4b70bfcd549cac26b7d1837f1ddb16e580f99b0c95814253446e51fe189766266a3a826e1511eedc71398c090be0f61343bcaf3c90d188ecaf4aa926111913849cd0ce8d38fdd99623f6f825c23c2843261eb1916f6a74b1848fd0ce3da42826d03debc7dcf4f9cb9fac102c08a19d7ac69d7e98646e843adae02e713e16c0be3891e66c4afcaf220146de06c30fb7dbb35ca6d2f5be5d2ec2a410eccbd214886da5307bbc541b2de1eed21fdc77d8e5f20f7e473c73e3e6e0d3149deb56372e8d7bb65617aced33cc442a846b1bcabed3807b2d0b5e174b29fdbc10a990f925bcd359d441b3abcbce3e3fefe142be2534fbe854b9eac7e1b044fd9915803b23b1cfc76f5125e9541ba9b6c96430a754fb00e4b3e518f3b600c0dd9c3c2973a2c7ae79606782bac75e601d793219acaf452b8c8b6e6558f168bc68d17c33c3ebf649cdcdfe6614187bb68630381690ee1842eac27ea5a7bb880ef21d955cfece3e7b06d616c763388f3055434260389a7870c907f2affefdc7c423dbc405551c2ebf576bc78a47eb7a92d2421d0f2a0bdf4dfcdcfa0dff7acdbdc12486fae3a5e8847c09be50ea87f1137e7f284e87d11d6386c364e38762057d453285915b02e038dc97a1024d84574ea2d2920329d854ad3765204a9aff2c635d02a83f75b55bcdf81119d0ea48038e839cb50cf0c8d7d04b7a19f6d677a698cdf4c0e057649a9110ed7ecf1a2918c7e5862e348ade05e1d370968f248b56d5f7504e4516ff4b4e0fd452ab7d17d3688357112e9997eeabb7d266149355851492dcd74603035da1f56dbd945ff947dc4a14de9ad1a518f22e5f3a3c36dd67e7aa4845ebf2db5ed8103e5e2bcb5f8c0b8e0ff9ac417fc7d9879c57581aa7a6e12e6ddba986a2d5fadfdf18e18b6f3753ce2fbcba1898d8defbe83d4f76f63524b9e45c3094c6dcaedb34d9d3a32271c5e28461ae3e0ac49916eb7432026f16c2e1bc245175580e082b63b75dae260f15a94dd4220c22a05ed04005263c276485c0e0e952c2616a3a198161d06c9b450a692111601b2812019feed077ffaded147a4f6fc9955e6e084c08ce3523b76579b7a96b98c6497319d94d6061b5fafd2d64d0dc65621859bb38ea1d83c2f0cf815a626b1904ea7fc77b1b336af6a7148f782ce70b54556b4780f88611df6294c503731f966b38fe46f6ae5884760f3e44755f9419be8374df618085239151861db00e79ed3feddb438bf65752e1cc206aa8ca396d4e092d403aef1f12207808c45a60878758cccd62864d4471d3f42c9f244a6280a50fe2a6abfa4f5168f1adbc54f2faec1eac08c67059d9808f2c3163e378e0607c7d85ca6f2cb2d76a92a06b05241d5cebedc8d7101d12b65a75eb33f06d532a3e3ae1f8ca98ca4c11b7ba37c8ddf0135ea1af6716148e614a3a58072fef1cf50503ad8e0b5d3fbafef0c16c93a39ef79ab2c2f4ccb0ec56972835abab3d3bc79ba6824fb07b4faee60d499f00f7d4063eb6c590205935b783ef532d8302a2e0ce5fb778d895eb1eb2fa36982c2d39d8d32c26b7c299ef5d8886fa61b9c45477fa06ca0e33747e72ad8ed724caa3931ff7c3644750f80fa9aee8277e6dff548fed8b3ceb17dea1d569b434a3c1b9f9d2043db4e413a003b368a58d9aa132a68a8bb56dc3cf43e2a36b1ad076b303e53425bd011005e537852fcfd857059addecc87d841905cf84a5e01b38bf73dc2522df44570c67c785cc7f1173cfd9e1cda3ffc1e8a7b728fe9e2692c9b962ac286cc31718dde007e8404347db741c250d84d93a508a9befe83284bc003b8b919e5bffc99cc3797f90412915b2a329b8f4134fa9bbed58840d9a7ca63ddef9805f48e93c05538fb6a28cd54b920980e94a9667a9f0df118229a252c9f9bd4e9562bd09e0615766a80debcba00eb1e79cf7ce37413572bf91cf1214eeffb20b255c1ac16d1fa45b94d6346dabbb3bf4a709f537517e9d326d7cd2997e6981e1d918587a6d52b8074b49987d7e44add0a9c44d286f8534dd9ab1e215fc6b910ec0c812c389fc647127c758b3a95e45d6481ca4b7999d63918a09c9d7b5ed89657e881ddaa4c0100f5d2266720085e089ac4a742b0c8591fc87daa54587d6cd2f6169266fcd236ef5fc9ad1925331ee04c52ccd7ba5bec4d72f595131f003306616112c31e201c0e37570775fb51fe4b46cf11bd885940cf02b57fbd4ca81b8c74614e0011881cb0b6a3a681067da2d4c4caa9e82cb34cfeb5a03b34390835be671fda838171006f4a0e474dcabd029ad6a8a68c0b66e6cb4a5630bdb8d0ca15485949280f9360122abe7663b4999aaef47ecf8c143bdd01faa42bc41b64abb33c9ad47acfde29ff66725ffc1edacec8483bae6b831e52b4ef369fc92b31670db0982987a4f2747cecdf73a68105e25556338c2198d982fd8ef9975e78acd29e96a6714671ce1ee5ba033b8b1fe345b88b90e75a81690d8efb0328c1aa6a4479a837f4eb1e0f19931ff3b424bd32277ffd6ebf4dbdd90f2b1d79f05ec62cae5f1eafa518b7db6c3a90fb588210a4708ca4403d9a9b6fb0690681b5192977592c1d98ed05f2f91fcd475f8d70d47995b9a95e913a1e9c038f40a0861fada213cda74b86eb69ba814d6d49a47fb1e049f80f4f5d6e388a1abf6dcd36930dde65cba4bc58a325d7ae8eb45e78d218e3035594899e43b3be78e853046640d7928932b4f8fd634c6964c87c1371807d4c0cba57d6015f19cddf4221f0978c8bbabfa81e741c4c719884cd35bde359ca064fe0dd2d7b9daafc1e7d99de00c2867c2694ab27ef9303932f3c4af230620a2c6c2d0f25f9f66e6b9135cd773cd361a801535a11288e2fbcf97243848af0a5f5474f15fd1a8be3615cf33e3e1513fb7643138c8e9af7dd841011a793053af4aa8a12d0e8eb1eb29e0474eb2d88c3e0e94ad875261dd7d6ac60b63b3ce8d511877fe3f0b4dbadde4c08d84ae1b3d5ee315c9bc03bb59e1c457b6348edc9bb52cc8250206423413745f80442f25cc38fe4e6bb5922027b9e44985216653321f4fc19bc9ab669e0fc6696a134340bb57a247f77b6e299afcbc07f2f9c09957cce7a775dfd6ee11a1689582a78b757aa88b2fa63ca225982c01a3d1950693e62399e558650b4f027b36853df23766bac2a841b884a16457b310b0e492c0041b56c212b2b036ab403ced09519e066b64bd6b5ef98c7e3a0b9d4885af7b81d735bbe2060499ef87cabac8261d8b8e34da6221cf307d73f74bf7e57ee49c2a1d4a619ddcba95708b033d15081af0b4ef17dd7c73920b9523f5cecc173be8826b898b726a1d6795c80af40e43b5bb963fe934f6601182be59ff9bce7df28dbff16710815b15a0a8f7973771b7098dd493c8fe7f12ba0ffc58ceb1c938098ff9b846d7800719b0b86ccaddb5ebdaee3cb7e6ca94e28274587cc6cda1c33de00b1a4e02f0fde18d6582ca83bdf5fbfc01229331ed2481ea9844a5ac4a7d6c5641d37098ad2ab09a32790921cead99ad6870c3c30af69fa42b96815ff51e7182d9c58849f3dd9b011d85a0939a9f3514d92412947e553d023f0cdf06d33a9113d51f73387d360476ec932ca87a3ca7cf85f99ff066dd87ecdab44fe44215fa7869c3d07ac620dd02552dd2fab8cc57817c3645b12407276d1369bb3c6f09ccc914bb10baa43f44856a3489db87e074135b4fa1a30b879fbe791eab05c3a567ee04454a48886a517153671835b09eb0d66e10301f75b393dd8957756f79", @generic="bd274313a62040c99dae44f7921186bb6785f6556c2d8e6c1296ea34a4c04f8dbcc909fe4193218dc21259aa8e2f47ecfc49793117b9bae448be638edb732a8ad99dd7c0fa1227882ccd57190ccac19c7c0e0b6fe719e042bb5932ee6b53ce00009b8f1385a5bf4b0bc9a548c95f32b5c3951c2a90ea590a2ab7825d9a8d98f6ad30"]}, @typed={0x8, 0xe, @u32=0x9}, @typed={0x4, 0x51}, @typed={0x8, 0x2e, @fd=r2}]}, 0x1338}, 0x1, 0x0, 0x0, 0x1}, 0x1) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000001640)={0x1}) r3 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x800000) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc0bc5351, &(0x7f0000000080)={{0x4, 0x800000000}, 0x2, 0x0, 0x6, {0xdd, 0xffffffffffffffff}, 0xff, 0x2}) [ 471.614675] binder: undelivered TRANSACTION_COMPLETE 12:01:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce813e9"}) 12:01:23 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000006c00) 12:01:23 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x6000000]}}, 0x1c) [ 471.772368] binder_alloc: binder_alloc_mmap_handler: 20991 20001000-20004000 already mapped failed -16 [ 471.798076] binder: BINDER_SET_CONTEXT_MGR already set 12:01:23 executing program 4: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x400000, 0x0) getpeername$unix(r0, &(0x7f0000000140)=@abs, &(0x7f0000000040)=0x6e) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) 12:01:23 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfsB', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 471.827739] binder: 20991:20996 ioctl 40046207 0 returned -16 [ 471.864431] binder_transaction: 25 callbacks suppressed [ 471.864448] binder: 20991:20999 transaction failed 29201/-71, size 0-0 line 2741 12:01:23 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000500) [ 471.882967] binder_alloc: 20991: binder_alloc_buf, no vma [ 471.900694] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:23 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xf4010000]}}, 0x1c) [ 471.948867] binder: 20991:20996 transaction failed 29189/-3, size 0-0 line 2973 [ 471.984697] binder: send failed reply for transaction 1153 to 20991:20996 [ 471.992257] binder: undelivered TRANSACTION_COMPLETE 12:01:24 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$inet(0x2, 0x80003, 0x3) setsockopt$inet_mreqn(r1, 0x0, 0x27, &(0x7f0000000080)={@multicast1, @local}, 0xc) setsockopt$inet_mreqsrc(r0, 0x0, 0x0, &(0x7f0000000000)={@rand_addr, @local, @remote}, 0xc) 12:01:24 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x8c5a, 0x281) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000280)) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x800, {}, 0x100}) 12:01:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce80ae9"}) 12:01:24 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xe]}}, 0x1c) 12:01:24 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400007000000) 12:01:24 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 472.210438] binder: 21038:21039 transaction failed 29201/-71, size 0-0 line 2741 12:01:24 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x100000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.stat\x00', 0x0, 0x0) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000280)={0x34, 0x11, 0x7, 0x9, 0x6, 0x190, 0x5, 0xdf, 0x1}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x80000000, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f00000002c0)={0x5, 0x0, 0x10002, 0x6}) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f0000000300)={r2, 0x1}) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000140)={[0x5, 0xd73, 0x1, 0x3, 0x3, 0x5, 0x8, 0x4, 0x5, 0x4, 0x3, 0x10001, 0xfffffffffffffffa, 0xcda, 0x2, 0x3], 0x0, 0x140000}) r3 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc0bc5351, &(0x7f0000000080)) fadvise64(r0, 0x0, 0x1ff, 0x0) ftruncate(r3, 0x2) 12:01:24 executing program 0: socket$kcm(0x2, 0x5, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='memory.current\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000c9500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r1, 0x180000000000000a, 0xe, 0x29, &(0x7f0000000000)="b90703e69bbf08bb6400001086dd", &(0x7f0000000140)=""/41, 0x69}, 0x28) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000240)={&(0x7f0000000040)='./file0\x00'}, 0x10) ioctl$TUNGETFILTER(r0, 0x801054db, &(0x7f00000000c0)=""/139) r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000500)=')\x00'}, 0xffffffffffffff35) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000004c0)={r0, &(0x7f0000000440)="df0ada0c3af685ff3b9e9451bd9ed46f33f45c2e2605ae72628814aff2afcb3cd29021e46079f99def9fe4d4c72ba99fed8ec276487fa36e79e6d3f34b64b864a4541a9ef6358a50f7277f1421d9eaadb36f13424afcef9b4da030ee0573074a"}, 0x10) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$kcm(0x10, 0x800800000002, 0x0) recvmsg$kcm(r4, &(0x7f0000002c00)={&(0x7f00000017c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x80, &(0x7f00000007c0)}, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="160000001a0081aee4050c00000f00fe078bc36f1600", 0x16}], 0x1, &(0x7f0000002c40)=ANY=[]}, 0x0) recvmsg$kcm(r4, &(0x7f0000000780)={&(0x7f00000005c0)=@in6, 0x80, &(0x7f0000001a40)=[{&(0x7f00000006c0)=""/99, 0x63}, {&(0x7f00000007c0)=""/4096, 0x1000}, {&(0x7f0000001880)=""/216, 0xd8}, {&(0x7f0000001980)=""/146, 0x92}, {&(0x7f0000000280)=""/6, 0x6}], 0x5, &(0x7f0000000740)=""/21, 0x15}, 0x0) recvmsg$kcm(r4, &(0x7f0000000580)={&(0x7f0000000380)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80, &(0x7f0000002a00), 0x0, &(0x7f0000002a80)=""/207, 0xcf}, 0x0) r5 = socket$kcm(0xa, 0x6, 0x0) getpid() ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40042409, 0x0) write$cgroup_int(r0, &(0x7f0000001840)=0x5, 0x12) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000003c0)={r0, 0x28, &(0x7f0000000380)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={r6, 0x5, 0x10}, 0xc) ioctl$sock_kcm_SIOCKCMCLONE(r5, 0x890c, &(0x7f0000000000)={0xffffffffffffffff}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000240)={r0, 0x50, &(0x7f00000002c0)={0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340)=r8, 0x4) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r7, 0x40042409, 0x1) ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, &(0x7f0000000200)=r3) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r2, 0x4008240b, &(0x7f0000000640)={0x3, 0x70, 0x7, 0x80000001, 0x0, 0x2c3, 0x0, 0xffffffffffff8001, 0x14000, 0x7, 0x10001, 0x6, 0x1, 0x0, 0xff, 0x8000, 0x2, 0x8, 0x8, 0x7, 0x81, 0x1, 0x9, 0x10000, 0x8, 0xb0, 0x5, 0x8, 0x401, 0x6, 0x78, 0x88, 0x5, 0x0, 0x4, 0x9, 0x7ff, 0x1, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000600), 0x4}, 0x8, 0xfffffffffffffffe, 0x9, 0x6, 0x5, 0x2, 0xfffffffffffffff9}) openat$cgroup_ro(r3, &(0x7f0000000040)='memory.current\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0xd8b4) 12:01:24 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xe00000000000000]}}, 0x1c) [ 472.296051] binder_alloc: binder_alloc_mmap_handler: 21038 20001000-20004000 already mapped failed -16 [ 472.379855] binder: BINDER_SET_CONTEXT_MGR already set [ 472.408517] binder: 21038:21039 ioctl 40046207 0 returned -16 [ 472.436116] binder_alloc: 21038: binder_alloc_buf, no vma [ 472.446184] XFS (loop3): Invalid superblock magic number 12:01:24 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000900) [ 472.457927] binder: 21038:21075 transaction failed 29201/-71, size 0-0 line 2741 [ 472.492464] binder: 21038:21056 transaction failed 29189/-3, size 0-0 line 2973 12:01:24 executing program 4: r0 = creat(&(0x7f0000000180)='./file0\x00', 0x80) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000280)={{{@in=@remote, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}}}, &(0x7f00000001c0)=0xe8) r2 = getgid() mount$fuseblk(&(0x7f0000000000)='/dev/loop0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000140)='fuseblk\x00', 0x2040, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@default_permissions='default_permissions'}], [{@obj_role={'obj_role', 0x3d, "c7"}}]}}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$VHOST_GET_VRING_ENDIAN(r0, 0x4008af14, &(0x7f0000000440)={0x3, 0x3ff}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc0bc5351, &(0x7f0000000080)) [ 472.547601] binder_release_work: 32 callbacks suppressed [ 472.547616] binder: undelivered TRANSACTION_ERROR: 29201 12:01:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce807e9"}) 12:01:24 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xff0f0000]}}, 0x1c) [ 472.598725] binder: send failed reply for transaction 1158 to 21038:21039 [ 472.643040] binder: undelivered TRANSACTION_ERROR: 29189 [ 472.704928] binder: undelivered TRANSACTION_ERROR: 29201 [ 472.732477] binder: undelivered TRANSACTION_COMPLETE [ 472.746026] binder: 21097:21098 transaction failed 29201/-71, size 0-0 line 2741 12:01:24 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:24 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000003) [ 472.762468] binder: undelivered TRANSACTION_ERROR: 29189 12:01:24 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0xc, &(0x7f0000000000)=@raw=[@map={0x18, 0xa, 0x1, 0x0, 0x1}, @initr0={0x18, 0x0, 0x0, 0x0, 0x100000000000}, @generic={0x2, 0x6, 0x7, 0x6}, @call={0x85, 0x0, 0x0, 0x28}, @jmp={0x5, 0x7ff, 0x7, 0x4, 0xb, 0xfffffffffffffffe, 0xfffffffffffffffc}, @call={0x85, 0x0, 0x0, 0x22}], &(0x7f0000000480)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0xffffffffffffffff, [], 0x0, 0x8}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x0, 0xca, 0x2f, &(0x7f0000000280)="8e7e0ddc48cf3c4d79cbe5634d3d2d11ef8f531a534d30ced46a5fd382063f52762d07a5feabf401b34ae388dd7ffff72372704edcc702aa9ed9942c203b7ba3e86a534e3601de2be1f8b150b4d9dc4e2aa1f9ba903235250fa0a4d2c245faccf77c9ed84aa4a73259d1a0e143cfdd214532a173c5c9fbb47d3e04d246d4101369270519d1011f1c41f8ec1887e0d158a20900353b6e5823b59fe13bd130bce7068a41d016120dc51461d80e21bb6fdd6eefa1b5c5b87192b4eea0cc0cb227dd606d60461106fe7de7e5", &(0x7f0000000380)=""/47, 0x2}, 0x28) [ 472.807718] binder_alloc: binder_alloc_mmap_handler: 21097 20001000-20004000 already mapped failed -16 [ 472.843092] binder: BINDER_SET_CONTEXT_MGR already set [ 472.875283] binder: 21097:21098 ioctl 40046207 0 returned -16 12:01:24 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xfe800000]}}, 0x1c) [ 472.956860] binder: 21097:21102 transaction failed 29201/-71, size 0-0 line 2741 [ 473.016692] binder: release 21097:21098 transaction 1163 out, still active [ 473.023886] binder: undelivered TRANSACTION_COMPLETE [ 473.024354] net_ratelimit: 3 callbacks suppressed [ 473.024364] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 473.048448] XFS (loop3): Invalid superblock magic number 12:01:25 executing program 4: r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x602, 0x60) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f0000000140)={0x9, 0x446, 0x9, 'queue0\x00', 0xfffffffffffffff8}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) 12:01:25 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xffb8]}}, 0x1c) [ 473.075246] binder: undelivered TRANSACTION_ERROR: 29201 12:01:25 executing program 0: memfd_create(&(0x7f0000000400)='\'', 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000140)="2b8b8a16114fdddf6b284699df92d53e6f4a02759b9461ac", 0x3) ioctl$FIBMAP(0xffffffffffffffff, 0x1, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0xfff) ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000100)=0x1) write$binfmt_misc(r1, &(0x7f0000000c40)=ANY=[@ANYRES32], 0xff67) sendfile(r0, r1, &(0x7f00000001c0), 0x4400) open_by_handle_at(0xffffffffffffffff, &(0x7f0000000300)={0x9, 0x0, "9c"}, 0x0) ioctl$KDGETKEYCODE(0xffffffffffffffff, 0x4b4c, &(0x7f0000000000)={0x0, 0x6}) fcntl$addseals(r1, 0x409, 0x8) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000200)={{{@in=@remote, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@dev}}, &(0x7f0000000040)=0xe8) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f0000000080)={@remote, 0x4c, r2}) membarrier(0x2, 0x0) 12:01:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce83ee9"}) 12:01:25 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400074000000) 12:01:25 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x6]}}, 0x1c) 12:01:25 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 473.219066] binder: undelivered TRANSACTION_ERROR: 29201 [ 473.235263] binder: send failed reply for transaction 1163, target dead [ 473.302908] binder: 21150:21151 transaction failed 29201/-71, size 0-0 line 2741 12:01:25 executing program 4: r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x82, 0x40) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1891, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000001, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x8}, 0x0, 0x8, r0, 0x0) set_mempolicy(0x4000, &(0x7f0000000000)=0x7, 0x7) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) sendfile(r1, r0, &(0x7f00000000c0), 0x9) syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x100000000000) [ 473.397385] binder_alloc: binder_alloc_mmap_handler: 21150 20001000-20004000 already mapped failed -16 12:01:25 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xffffffff00000000]}}, 0x1c) 12:01:25 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, @perf_bp={&(0x7f0000000000), 0x6}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) r1 = open(&(0x7f0000000040)='./file0\x00', 0x4000, 0xc) ioctl$NBD_SET_TIMEOUT(r1, 0xab09, 0x400) 12:01:25 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400009000000) [ 473.441047] binder: BINDER_SET_CONTEXT_MGR already set [ 473.459478] binder: 21150:21151 ioctl 40046207 0 returned -16 [ 473.469616] binder_alloc: 21150: binder_alloc_buf, no vma [ 473.490985] XFS (loop3): Invalid superblock magic number [ 473.496677] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 473.501347] binder: 21150:21165 transaction failed 29201/-71, size 0-0 line 2741 [ 473.529090] binder: release 21150:21151 transaction 1167 out, still active [ 473.537059] binder: 21150:21151 transaction failed 29189/-3, size 0-0 line 2973 [ 473.555068] binder: undelivered TRANSACTION_COMPLETE 12:01:25 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x100000000000000]}}, 0x1c) 12:01:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce82ee9"}) 12:01:25 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400003000000) [ 473.594698] binder: undelivered TRANSACTION_ERROR: 29201 [ 473.601930] binder: send failed reply for transaction 1167, target dead [ 473.625098] binder: undelivered TRANSACTION_ERROR: 29189 [ 473.635856] binder: undelivered TRANSACTION_ERROR: 29201 12:01:25 executing program 0: memfd_create(&(0x7f0000000400)='\'', 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000140)="2b8b8a16114fdddf6b284699df92d53e6f4a02759b9461ac", 0x3) ioctl$FIBMAP(0xffffffffffffffff, 0x1, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0xfff) ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000100)=0x1) write$binfmt_misc(r1, &(0x7f0000000c40)=ANY=[@ANYRES32], 0xff67) sendfile(r0, r1, &(0x7f00000001c0), 0x4400) open_by_handle_at(0xffffffffffffffff, &(0x7f0000000300)={0x9, 0x0, "9c"}, 0x0) ioctl$KDGETKEYCODE(0xffffffffffffffff, 0x4b4c, &(0x7f0000000000)={0x0, 0x6}) fcntl$addseals(r1, 0x409, 0x8) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000200)={{{@in=@remote, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@dev}}, &(0x7f0000000040)=0xe8) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f0000000080)={@remote, 0x4c, r2}) membarrier(0x2, 0x0) 12:01:25 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:25 executing program 4: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x2b8b, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xd6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x100}, 0xb) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r2, 0xc0bc5310, &(0x7f0000000140)) fgetxattr(r2, &(0x7f0000000280)=@known='trusted.syz\x00', &(0x7f00000002c0)=""/223, 0xdf) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) [ 473.782535] binder_transaction: 15 callbacks suppressed [ 473.782545] binder: 21197:21209 got reply transaction with no transaction stack [ 473.802972] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:25 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xf401000000000000]}}, 0x1c) [ 473.844776] binder: BINDER_SET_CONTEXT_MGR already set [ 473.850598] binder: 21197:21225 got reply transaction with no transaction stack [ 473.850634] binder: 21197:21209 ioctl 40046207 0 returned -16 [ 473.869621] binder: release 21197:21209 transaction 1172 out, still active [ 473.878216] binder: undelivered TRANSACTION_COMPLETE [ 473.886425] binder_alloc: 21197: binder_alloc_buf, no vma 12:01:25 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0xd}) 12:01:25 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000007400) 12:01:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce830e9"}) [ 473.939334] binder: undelivered TRANSACTION_ERROR: 29201 [ 473.963067] XFS (loop3): Invalid superblock magic number [ 473.995889] binder: send failed reply for transaction 1172, target dead [ 474.021507] binder: 21238:21239 got reply transaction with no transaction stack [ 474.056427] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 474.065806] binder: BINDER_SET_CONTEXT_MGR already set [ 474.077177] binder: 21238:21239 ioctl 40046207 0 returned -16 [ 474.092338] binder_alloc: 21238: binder_alloc_buf, no vma 12:01:26 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x1ffffc) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{0xffffffffffffffff}, 0x0, 0x0, 0x0, {0x0, 0x2}}) 12:01:26 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x40000000]}}, 0x1c) 12:01:26 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:26 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000001c0)="153f6234488dd25d766070") connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @mcast2, 0x800000}, 0x1c) sendto$inet6(r0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000340)={0xa, 0x4e21}, 0x1c) 12:01:26 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000600) [ 474.104392] binder: 21238:21256 got reply transaction with no transaction stack [ 474.122210] binder: release 21238:21239 transaction 1177 out, still active 12:01:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce841e9"}) [ 474.195433] binder: send failed reply for transaction 1177, target dead [ 474.248374] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:26 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x13, 0x10, 0x3}, 0x2c) r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000002c0)={&(0x7f00000000c0)='./file0\x00', 0x0, 0x18}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r1, 0x0, 0x49, 0x19, &(0x7f0000000300)="ad1fc98bdf82c274086a02ab4f215c04e40713afd5e44722d1c008b40c1d75641a50fc95e1831fb026ced7f841da931d866ec8a1aa6b043b122e564c64b68f6b216ceccf2d49d44130", &(0x7f0000000380)=""/25}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0xb, 0x5, &(0x7f00000003c0)=@framed={{}, [@map={0x18, 0x0, 0x1, 0x0, r0}]}, &(0x7f0000000440)='syzkaller\x00', 0x5, 0x401, &(0x7f0000000200)=""/144}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000005580)={0x10, 0x2, &(0x7f0000000080)=@raw=[@map={0x18, 0x0, 0x1, 0x0, r0}], &(0x7f0000000000)='syzkaller\x00', 0xbe10, 0xee, &(0x7f0000000100)=""/238}, 0x48) [ 474.331878] binder: 21276:21277 got reply transaction with no transaction stack [ 474.367077] binder: BINDER_SET_CONTEXT_MGR already set 12:01:26 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x142800]}}, 0x1c) [ 474.379593] binder: 21276:21289 got reply transaction with no transaction stack 12:01:26 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='io.stat\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000002, 0x20010, 0xffffffffffffff9c, 0x3f) bind$bt_sco(r0, &(0x7f0000000100)={0x1f, {0x4, 0x1, 0x8, 0x92e, 0x2, 0x80}}, 0x8) r2 = getgid() r3 = getgid() setregid(r2, r3) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={r1}) r4 = syz_open_dev$sndseq(&(0x7f0000000140)='/dev/snd/seq\x00', 0x0, 0x2) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r4, 0xc0bc5351, &(0x7f0000000080)) [ 474.415853] binder: 21276:21288 ioctl 40046207 0 returned -16 [ 474.449896] XFS (loop3): Invalid superblock magic number 12:01:26 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000006) 12:01:26 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x85a, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r0, r0) 12:01:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce83ae9"}) [ 474.464787] binder: release 21276:21277 transaction 1182 out, still active [ 474.490525] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:26 executing program 4: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000140)={{0x8, 0x7f}, 0x1, 0x6, 0x6, {0xffffffffffffff81, 0x200000000000}, 0x100, 0x2}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) 12:01:26 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x1600]}}, 0x1c) [ 474.574783] binder: send failed reply for transaction 1182, target dead [ 474.633240] binder: 21317:21319 got reply transaction with no transaction stack [ 474.642672] binder: BINDER_SET_CONTEXT_MGR already set [ 474.661662] binder: 21317:21319 ioctl 40046207 0 returned -16 [ 474.664871] binder: 21317:21323 got reply transaction with no transaction stack 12:01:26 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfsz', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:26 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000010) [ 474.695026] binder: release 21317:21319 transaction 1187 out, still active 12:01:26 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x50000]}}, 0x1c) 12:01:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce80ee9"}) [ 474.748452] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 474.784778] binder: send failed reply for transaction 1187, target dead 12:01:26 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0x0, {0x8000}}) 12:01:26 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x281400]}}, 0x1c) [ 474.923225] binder: 21342:21343 got reply transaction with no transaction stack [ 474.951144] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 474.955716] binder_alloc_mmap_handler: 4 callbacks suppressed 12:01:26 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000004800) [ 474.955749] binder_alloc: binder_alloc_mmap_handler: 21342 20001000-20004000 already mapped failed -16 [ 474.983257] binder_alloc_new_buf_locked: 2 callbacks suppressed [ 474.983264] binder_alloc: 21342: binder_alloc_buf, no vma [ 474.983421] binder: BINDER_SET_CONTEXT_MGR already set [ 474.999349] binder: 21342:21356 got reply transaction with no transaction stack 12:01:27 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0xb5a) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{0x3}, 0x0, 0x0, 0x3, {0x4}, 0x1, 0x101}) 12:01:27 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x42bb050000000000]}}, 0x1c) [ 475.051484] binder: release 21342:21343 transaction 1192 out, still active [ 475.058994] binder: 21342:21343 ioctl 40046207 0 returned -16 12:01:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce826e9"}) 12:01:27 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667304", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 475.105348] binder: send failed reply for transaction 1192, target dead 12:01:27 executing program 4: ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f0000000000)={0x3, 0xffffffffffffff9c, 0x1}) readahead(r0, 0x3, 0x6d) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x4800c0, 0x0) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000000140), &(0x7f0000000180)=0x4) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000280)={r1, 0x28, &(0x7f00000001c0)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000002c0)={r2, 0x2}, 0xc) r3 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc0bc5351, &(0x7f0000000080)) 12:01:27 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x40000000006c) [ 475.191695] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:27 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x42bb0500]}}, 0x1c) [ 475.308795] binder_alloc: binder_alloc_mmap_handler: 21379 20001000-20004000 already mapped failed -16 [ 475.344462] binder: BINDER_SET_CONTEXT_MGR already set [ 475.351445] binder_alloc: 21379: binder_alloc_buf, no vma [ 475.358035] binder: 21379:21387 ioctl 40046207 0 returned -16 [ 475.446291] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce84ae9"}) 12:01:27 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x4000e1efff7f) 12:01:27 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\r', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:27 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x44000, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) 12:01:27 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:27 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x3000000]}}, 0x1c) [ 475.731266] binder_alloc: binder_alloc_mmap_handler: 21407 20001000-20004000 already mapped failed -16 12:01:27 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x7fdc]}}, 0x1c) [ 475.776473] binder: BINDER_SET_CONTEXT_MGR already set [ 475.787124] binder: 21407:21408 ioctl 40046207 0 returned -16 12:01:27 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x40006c000000) 12:01:27 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x1000, 0x200) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x4, 0x3, 0xfffffffffffffffd, 0xf11, 0x4, 0x100000000, 0x5, 0x401, 0x1, 0x9, 0x101}, 0xb) syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000140)={'veth0_to_bond\x00', 0x600}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{0x0, 0x8000000000}, 0x0, 0x0, 0x0, {}, 0x0, 0x1f}) 12:01:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce829e9"}) [ 475.818910] binder_thread_release: 1 callbacks suppressed [ 475.818922] binder: release 21407:21408 transaction 1202 out, still active [ 475.837625] binder_release_work: 5 callbacks suppressed [ 475.837630] binder: undelivered TRANSACTION_COMPLETE 12:01:27 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667388", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 475.944771] binder_send_failed_reply: 1 callbacks suppressed [ 475.944779] binder: send failed reply for transaction 1202, target dead [ 475.958802] XFS (loop0): Invalid superblock magic number 12:01:28 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xfc]}}, 0x1c) [ 475.989379] binder_alloc: binder_alloc_mmap_handler: 21455 20001000-20004000 already mapped failed -16 12:01:28 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x40}) [ 476.035152] binder: BINDER_SET_CONTEXT_MGR already set [ 476.054222] binder: 21455:21456 ioctl 40046207 0 returned -16 12:01:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x6000, &(0x7f0000000480)="bce854e9"}) 12:01:28 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000300) [ 476.152507] binder_alloc: 21455: binder_alloc_buf, no vma [ 476.189889] binder: release 21455:21456 transaction 1206 out, still active 12:01:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce833e9"}) 12:01:28 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xff00000000000000]}}, 0x1c) [ 476.202559] binder: undelivered TRANSACTION_COMPLETE [ 476.204398] binder: BINDER_SET_CONTEXT_MGR already set [ 476.229973] binder: 21472:21480 ioctl 40046207 0 returned -16 12:01:28 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:28 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x6}) 12:01:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) [ 476.307268] binder: send failed reply for transaction 1206, target dead 12:01:28 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000004c00) [ 476.388417] binder_alloc: binder_alloc_mmap_handler: 21490 20001000-20004000 already mapped failed -16 [ 476.437388] binder: BINDER_SET_CONTEXT_MGR already set [ 476.453033] binder: 21490:21491 ioctl 40046207 0 returned -16 [ 476.461569] binder: BINDER_SET_CONTEXT_MGR already set [ 476.480250] binder: 21500:21509 ioctl 40046207 0 returned -16 12:01:28 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x1000000000000000]}}, 0x1c) [ 476.493664] binder_alloc: 21490: binder_alloc_buf, no vma [ 476.506735] XFS (loop3): Invalid superblock magic number [ 476.532100] binder_alloc: 21490: binder_alloc_buf, no vma 12:01:28 executing program 4: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000000)) r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)={{0x0, 0x6}}) r2 = dup2(0xffffffffffffff9c, r0) ioctl$KVM_GET_IRQCHIP(r2, 0xc208ae62, 0x0) 12:01:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce846e9"}) [ 476.547670] binder: 21500:21525 ioctl c0306201 200001c0 returned -14 [ 476.565092] binder: send failed reply for transaction 1213 to 21490:21491 [ 476.572169] binder: undelivered TRANSACTION_COMPLETE 12:01:28 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x9f) 12:01:28 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs`', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) 12:01:28 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xf5ffffff00000000]}}, 0x1c) 12:01:28 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) socket$vsock_stream(0x28, 0x1, 0x0) [ 476.747978] binder_alloc: binder_alloc_mmap_handler: 21536 20001000-20004000 already mapped failed -16 [ 476.830765] binder: BINDER_SET_CONTEXT_MGR already set 12:01:28 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x4f) [ 476.852593] binder: BINDER_SET_CONTEXT_MGR already set [ 476.864129] binder: 21536:21539 ioctl 40046207 0 returned -16 [ 476.874840] binder: 21547:21555 ioctl 40046207 0 returned -16 [ 476.891331] binder_alloc: 21536: binder_alloc_buf, no vma 12:01:28 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xb8ff]}}, 0x1c) 12:01:28 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:28 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x10000, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x10, 0x30, 0xfa00, {&(0x7f0000000140)={0xffffffffffffffff}, 0x0, {0xa, 0x4e22, 0x1, @ipv4={[], [], @loopback}, 0x1ff}}}, 0x38) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f00000001c0)={0x11, 0x10, 0xfa00, {&(0x7f0000000040), r1}}, 0x18) r2 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r2, 0xc0bc5351, &(0x7f0000000080)) [ 476.920371] binder_transaction: 31 callbacks suppressed [ 476.920388] binder: 21536:21563 transaction failed 29201/-71, size 0-0 line 2741 [ 476.937724] binder: release 21536:21539 transaction 1220 out, still active [ 476.945463] binder_alloc: 21536: binder_alloc_buf, no vma [ 476.951334] binder: 21547:21555 transaction failed 29189/-3, size 0-0 line 2973 [ 476.973359] binder: 21536:21543 transaction failed 29189/-3, size 0-0 line 2973 [ 476.991666] binder: undelivered TRANSACTION_COMPLETE 12:01:29 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000007) 12:01:29 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x3]}}, 0x1c) 12:01:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce839e9"}) [ 477.031706] binder: 21547:21555 transaction failed 29201/-71, size 0-0 line 2741 [ 477.052892] binder: 21547:21555 ioctl c0306201 200001c0 returned -14 [ 477.071595] binder: send failed reply for transaction 1220, target dead 12:01:29 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = semget(0x2, 0x1, 0x80) semctl$IPC_RMID(r0, 0x0, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000140)='/dev/snd/seq\x00', 0x0, 0x400000) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) [ 477.179591] XFS (loop3): Invalid superblock magic number 12:01:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) [ 477.223092] binder: 21594:21601 transaction failed 29201/-71, size 0-0 line 2741 12:01:29 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xe803]}}, 0x1c) 12:01:29 executing program 4: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x101000) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000280)={{{@in=@dev, @in6=@ipv4={[], [], @multicast2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast1}}, &(0x7f00000001c0)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000380)={{{@in6=@mcast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000480)=0xe8) fstat(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000900)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$GIO_UNISCRNMAP(r5, 0x4b69, &(0x7f0000000940)=""/208) fstat(r0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000005c0)={{{@in=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@ipv4={[], [], @multicast2}}}, &(0x7f00000006c0)=0xe8) r8 = getuid() getsockopt$IP6T_SO_GET_ENTRIES(r5, 0x29, 0x41, &(0x7f0000000cc0)={'security\x00', 0x1000, "3a71e892d63db8b0449da00a8b9034f73bea43e0c2447e1cf4beca52b688816877f48ec12e7fb79574cbf085a36feb8e39b6d04935541d651232b67fc20615a567a88ef625bc5e3582eccf040dcceaa73db2a72cfaffb8bec7188f2ce59e4f5df61a150e35b01166e14a6d6e5b15f514bc83121bcc47fa7b6eccdd7c576967b40d94941906d56522baf5050bd2b8967ac253d873d18dc8f0d73167e810d1864042bbbbd7f804b67db3ca6520dedf13bd80347695f50d82ff873feec4f2f08eab93126b1607b720d81b0dc99690dae4dd4881797b120abb59151ad941d16b0a6cf1200f43659c19efcc6125a3cf7173b8d192050442282a1a83a86ab6bf7665e838aa070493dc385b211c53a95f12dc9dc17cedf0e616c34bb700e502eec65487f830f07b4a67186a606e55644576ad823a8f33ac816d30159bfd3a86e329cde0a7e3c89b3520a8f579578bd28beb5fc7a2314a5c2f4b8e3716ed5d59e500d1ba977e70e6e38967de1ec210b7960d10c22a59019ce038110f1087cbaccdbcb802b75cc99ba15623796e6bee701ec7f0a758d10bc83d7289de32a2f65bb74f107f597bc4f6ea109dc9fca0f7c5668b6c6dbbc0cfb618bcd54ee09774867891ab501ce786883f5e6fc93f663b32ffd4d7a13cea221b543ea1eb4dec2f275f3d62918437c33ccfb419806be376592fd49563787a2f623604c4103f0884da5a3a189faaa7ed8d0591446307ef69f1677f52875154300d0d0e886923676d454232b74dda6e072e4471537a8ef2ea0a1a76ba54aebc5f7c1726adc935f6bdc7d9b5179406c486d593523a8acfa80d3b7d4f9969e49c905a717ce59d95f11f3154d95899388bc42099e8fbd3d4b6f8e9ea19f70da4da5e332b61a65b9ce915c73f187687b7b81a301b98cd85da000c6f1cb94bf2b887a5feefbfbc36ac25eab177346c5750e7c730849ca70bcb02a60327a1f74d3201a7bef6a2cf65e18ccddd63b5e86387d0cf04662923b7994d05cf9b6ea567d32f0252d039dade961ce3939c6788e535d10428f0b9615be153f802dff5b724e45caa95c998a4f0b1d3cc872bb614d71f33512866ec8277dba52863b96df799d4213de29a8790cba3f5b35ce1f62be699bc6b38c42ee7a376edfefe20261000cf53ea193800ca69946834bc7625e2ab74bd00c4183015792a5b9a8d384d6de9270bc8c9fdbd6dbe32395eccb1e237d213eba12436a9d807b9e99a7f4430771916257baa375c33b3d3bab9e7b03ea0ef3d9456a89a43cb07caf24e5a3ded9ab116ea659b9d4bad69821586ef98ea99f2d58123db1e98b4368e37f8759dd6fb0f899a43f77c13d3bdf9295b8c04f95c8ecba3e88b485d80ed27f24363eb737813bc886cb03d7738333e64fad38c54705dc39dcaa3a9f3b34949858d015a8c0ee1b64099429a799893fed7aeaf52f07510a0a85394a66761a091a99832129823d098eeea69e43c3b620e4f2ba1f464bd14805aa97c410a51d032de28b330b99768d0bcd8bf7766193490a6155d3b82b89437928fbacd5181354c0ac163900b895a25a42036c9dc415581af35f5c751ed18901598cd5b422175ad9c2bc64c046a882644f9af32be12fb6f272eddb1fc7d51881d54c01c8bd6c2a6bec5d45d6a934fab9c116dce470d01fe87b9280f5581a0759dc0f8eed8d67d119050043f32537e8e66db945804354a27ad684c4ff570349a4ebbdcdf78e6a874f21346a6fb06006929d613edeeb91dd73cb9837b62fa2fccd7b888480bfd13334ad4168cd74629e5699bba6365295f6e33360436c6e45fc87e701edf41856396a4dbd6504a3ea8124867493775cc432c5e87fbe8fbfbaaa068f3519307f3d4b0141fc70f9acc914382ad79b51be8e8ec1572c41ab99ecc39d5e4c878d8c2fa8788a9f553f3a79cf1e2285952724233091992ed1aa5e3a88e77cd86234b541cfaaa12ee62bfebc139cdf73355ec0dc46b61f80cbc78eb0445917dbddd196289e96d264f04c1fc4da472368cc1e6f46b2ada7a3bfa3f16080dab60299de4c1375c9915f2757c3ea9ab3e66beb55c9609b6705d02e67605676a2f8a123e300cef33c22cad7cc60e865a16f9f339132bb9632ed9c38547eb4495bfd27157b8f5830f2596f6701613111a317256d4f6748028ba396c0026c91cab0844ba52179bb79666a9d3db31d56dfa0b75ed31b2ff7f8df231dfd0acd9094bfad3afa7b762f43570c1736e610eb7330d1831c9cc3b3139aae7ab1b80f88f2e0d26566c6865326d7a17cc51299a550cd3187e42116cc0d23637fbe5c90347444477cec0b413d3dca14ca5853e767b9778e1b1c35eae626c264b075320d36b1ce34a393da7bc40a3931429c653e0bcc01d51f424f64df230fecb61d1bc5634e0342d04de421c4176ec3e0b47839a3cad2de22906de3943e7918edc436395cebf440cc200d7d144a5e236aa0751ff2cac63debcd1512c7b17629fdea9fa1896a4aed6157e10d5d2782802372e199797e0a72da0b864baf30bc84ea64bf2b689aeda29612eaa73861178be799f54a45782879d9cbf8762c365ffb3f9c84b6670bcb6e85565175b7471a138d7dbd6ad4233220dc09d60d53a31eff33cd56991da8eec95603cc6df6e7c0dc1738361a9ddf9cac789bc96c8d366a37f4d92358963d37df1f7c0c7750265ad0c874623711590ab8eae438cf74031649d35a080e916e38bca74b9b6335e768bed5aa220b116eec95c0054268fa95515582fe264201991a4e6c9cde6f1d57ad9f31f5478584716088d7f772075255a08d959b12a2c29b37ab406755afb34edfa80f09b2e24cf9cb77761ae0d9b3ca59eeff322f25545bd2921bbd534da15e93db1a3a0a547bd09db3b98fb727bffacf264fc774421a44341d1cb857a9c178c20bac422899c62c71599dfbdc5b42af76e7ba5f0a4bb0e870c99dbcccb77958591ac2fc0d7d2c186b5a9226991d1bea24b64be1fc61a43020593647993e4e45fc8e56352e97aac0c01426a56b1470828b57ac2994c7d55e63d8519a1584e5e3a0f775a7f68a3836e496a23aac04702f4968ddc341f2dbc10635b3566a6812db1f2d80c96af381c24fcbc9341f4e76c085e3709da9ab0e0241520c969b958fd236de1a9597db92cedaa2328da3aa6c40bb2d5d9e858c09d8c8ed74d348af452c7a6ad5e9727a6c4a1952c776423bd675a3802d4106f9a41b2e7f0b5096a4e3ed0bac7b54702ae15620e1e45b223260a14b59f825ff6da28f137df19da17b3f2ebebfeab801281ced1266bd7aabebd83a91afdfd27b8585ba7d3d799b68f09590c2e1882f6efd0677266c96b2df8478ef72470562ad86e766f5dca27323e6349e7a48393d7b65efbea2fa64cc93487f0acae6e31560972288735637114c9385880e72f1a163ea300dc83da44a1031cb35eed0940a5e6d85f39579fcf3b0534b8a32d6e68b3e16161df1d24f9963be0b21ca42fae76278ac709ba5cf9592063637acad1ba6a8478a9aaeb9edd60318dbea1a2bb74dfe2e08daadfa1e4f04f3d0b7218391bfc596e50491b3d1ada2bcb25b764db4edf803e8a4f6b09e52d988134f34893a4f4c285880a0fe745db9913a45428eaaa1a671c40ba49d8ec2ca4f8a1e407d4f4fbb83ef1307eb7573a503d0dfac544afd6ad3b3448862ce032a5f2aa7e290b992c4c87f5121e3585a752ccaef8fb213a744b348e9193219f9f070e31cca8c810fc71957851abf5c699ae3e103c4ba1fad8f85aa13cbbfa2bc6654b1411677291bbf26c3a3e20152136c8f32fc7fc8c1fbfd24c2b0d765fa60f1999a1440b1dc91877a75f15e37908600dc3d60408eb8e2ecd24636772829d8c7a20407a02088297f0d496c94b24b2aaa1288b19f48c6b07e8d95ee62f054036ae90c8ce18fc3bdd83664fd615024ba4375232a2fff46e3a2a167fb4a450a3c15b587c188f7171fe189d62860cff4bda15058a922b516d3fa4a2aa9d2bd850ff3496371136d24327d39409eadd71b326d2680353b9e0bc4dbc55cb7f08ccebe22ea204b4a824dbd77c71ddc974fd9103f00d4de380fe1c08c68d39dc02d33ef0f5919c69bfb1693d2361979dafd9d4c2c61222e66b2b2807d69986af31c4d0dd4da02afb3af7220c59c72cc7a792a4ea83e8f42e0e659a49144d130d15b9ccb03f22005ddf7e820e903abf91d6e18c9f57a890c6b46147a186ee17bcdf0aac46c456aa7b879bc3448dc90e930ebe4cd1146acdeee8335e8c0a195bcb2cbc397ce2faa972480ea2a9abe8b5e2c073a6435261eeb5d759a221b6e2a0a775e43e51d9f0f65f1167a74f9c8bf59cd89de6dfa20d7521483de79988e0a61ce205596b3e797f5464e6bcf2b74d4c953c0938818cf237dacdaab12608613fe98bc2620364deda1b8dd5dd15bb0d9ee6bc23a716ad5459688ff7045c1506c049d35a2a29852401967625f3de8e4f9848c347afd70499e5c45369cbd159631be0769c0579ba67f62aba5f27e046c8ca056688fe201a5b9bef40eacdcf478d0fb2f487c54add2e661e3aa891e6d0095f32439a601e7cee1afb7f1af3ce431ecb52b3758094ae8874398ec55db937ff3fc2b1a6a45a85d493f61d8173bb9f2e05c98d3984b11d287c346179ef51f845577be14df2017011c1a6ff67ce75f6d6f52c426783c0ddf4a6fad3a07119c915f883207d454b14b0f4fe4b9f96757400f3671f762a61ffe288772acbd5d76d1eaaf24195affa94c99273e1d0eda4cb16347c9a7c3fe61154c150d60888358c583754ecd7679a559681da10fc10082c3ac2423760e4026f2a6de9d900f51dfa778dcd481f35402e0fb72ce8e464988138ecc4211346e36e3bab1b9696919f65634df9522ac3d7e2bebbb00b76ace4351148d2d2526a2dc21f0f44131cc14a41245784b0858bb5572b11e71d57b158740ae66105828a55af1857daade857162fdbbc7b2b873747a7d16edf65b6cc3453beaf71878183f1fbafd0ceed408ecc83cbf6ac5c3124089a12578b99fbc3039e0c536c34adfe3224706fa02482765eafb567cc0dcf07db686eba5b5c1a42f807e1d1d78eccc40aa2bf2c7b9a0fe3233f839301266b483eccccd170ab8857e0f1c8ead6ae7a1192f43e3cdb82847a988d81f9f5f041c09248000a98aa792a3e172cffad392a28408a4cf69241b84cac9421d79ae01d408610e54bb526c19a7dfda0946fd2a18b73b9ad641c12a4d61ce6cece29cd5995d3d5a61579c648bc9a00a44dd9bbb42d27b6bcda4985e98c68f1d3f804f5796918811c879e3c1778d751026d2bdfdbae10da58c1880c103540a70c53aaa9b5598fef94ddab4478bab1794bbb33173001f2ae9dfb293f8d9613fc1dc316f985a29e4d979e10b9ba10d55a927eea34227c0136003191332ae2940dfd3e960794cb7a203f6ceebb1850ba7d7a081a428e63b563dca84920bad379f747a3837d322749de35b54afd0eca8352444d213baa1d6666480132ea9bd950254943cb24a17c82a3b5e43b4351f9716e83ad3b5c74019d86eefbde391c92f45410b01f2a7e753df17f4a4232d82ec0ad8789f7110a7e4068985c7581fc98089ba792d505829c1f3d4c2145edff49a2331a4a69a50d40a72897f6ec814e7d49f238f939b1224e83be3897ea4596f1b8a3b3162f65da7cd843ee05619f3134734edecfb64b141bdd1f9284aa6d71a8b67994d174beef98c8ca9bb07442d5172015c7440d5dda08e3b06a4e069fec71cc2544f0966864b264be5cdbb22c7a0551fab2172e70bfd7d32d48e84ee8e483569ef35f"}, &(0x7f0000001d00)=0x1024) r9 = getegid() getgroups(0x3, &(0x7f0000000700)=[0x0, 0xee00, 0xee01]) getgroups(0x1, &(0x7f0000000740)=[0x0]) lstat(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r13 = getegid() r14 = getgid() lsetxattr$system_posix_acl(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='system.posix_acl_access\x00', &(0x7f0000000840)={{}, {0x1, 0x5}, [{0x2, 0x4, r2}, {0x2, 0x2, r3}, {0x2, 0x1, r4}, {0x2, 0x3, r6}, {0x2, 0x6, r7}, {0x2, 0x4, r8}], {0x4, 0x4}, [{0x8, 0x2, r9}, {0x8, 0x6, r10}, {0x8, 0x7, r11}, {0x8, 0x9de7436107402783, r12}, {0x8, 0x2, r13}, {0x8, 0x6, r14}], {0x10, 0x4}, {0x20, 0x5}}, 0x84, 0x0) r15 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x80, 0x1a0) ioctl$UI_GET_VERSION(r15, 0x8004552d, &(0x7f0000000040)) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)) sendmsg$nl_generic(r5, &(0x7f0000000c80)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x100008}, 0xc, &(0x7f0000000c40)={&(0x7f0000000a80)={0x1a0, 0x3e, 0x0, 0x70bd25, 0x25dfdbfc, {0x5}, [@generic="4ee9b0c3de8bd315e4ba2b5d53da0884be9a8582af6b0600583169dceab6f002fa82b2175e70dc01513fe94c0aa40f3cce87c867ced8639606e747f2e5fd20e780360f7d1386af590d8000fe482fab817a4a864348b64db0a9af756f7bc80f030fe64b62145b27b432986c5a4f54417b085340869207bc4861e43ac35200f506386aa4d3eb4479979af2bf2400d1173e1dbf3fb05d06886f965d865df418a912cbecea53d71344581c0b2859b2fd", @typed={0x4, 0x2}, @typed={0x8, 0x17, @u32=0x9}, @generic="73cd62e786d10361fda9a5813f5f60a30da3a04588868adb7ff2fc2193a26f863fa4c47633236cb3790fe70055ab7d58e9dfb9711e763e10000bc8c65d7e7a9be67a7e13fb40c3d19863e3a92058b3cb3c5e665211aa69624640dffb443be1e71291570fb03d36e9cb74d0225dc8ac87ac", @nested={0x60, 0x1d, [@generic="7fee0329580c880f53f29f27f7503b23b4b66aa62cf2d65a88004f1b39ed6bc187b1c0dc21691c8505087aab31c84551f198d2a4713cad8a41538a3db6433aea241887f30027c32e8c9bdb45b1cb964e717470a1e78389f7a2e7d1cd"]}]}, 0x1a0}, 0x1, 0x0, 0x0, 0x8000}, 0x40) 12:01:29 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400048000000) [ 477.270113] binder_alloc: binder_alloc_mmap_handler: 21594 20001000-20004000 already mapped failed -16 [ 477.287573] binder: BINDER_SET_CONTEXT_MGR already set [ 477.300999] binder: 21611:21613 ioctl 40046207 0 returned -16 [ 477.312059] binder: BINDER_SET_CONTEXT_MGR already set [ 477.327000] binder: 21594:21618 transaction failed 29201/-71, size 0-0 line 2741 12:01:29 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 477.375950] binder_alloc: 21594: binder_alloc_buf, no vma [ 477.382904] QAT: Invalid ioctl [ 477.383544] binder: release 21594:21601 transaction 1227 out, still active [ 477.393842] binder: undelivered TRANSACTION_COMPLETE [ 477.401261] QAT: Invalid ioctl [ 477.406976] binder_alloc: 21594: binder_alloc_buf, no vma [ 477.412669] binder: 21611:21613 transaction failed 29189/-3, size 0-0 line 2973 12:01:29 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xdc7f]}}, 0x1c) [ 477.430122] binder: 21594:21609 transaction failed 29189/-3, size 0-0 line 2973 [ 477.451421] binder: 21611:21623 transaction failed 29201/-71, size 0-0 line 2741 [ 477.455160] binder: send failed reply for transaction 1227, target dead 12:01:29 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6, 0x90000) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) fsync(r0) [ 477.494915] binder: 21611:21623 ioctl c0306201 200001c0 returned -14 [ 477.504617] binder: 21594:21601 ioctl 40046207 0 returned -16 12:01:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce81be9"}) 12:01:29 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) 12:01:29 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x8dffffff]}}, 0x1c) [ 477.614268] XFS (loop3): Invalid superblock magic number 12:01:29 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400068000000) 12:01:29 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f00000002c0)='/dev/snd/seq\x00', 0x0, 0x204000) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f00000000c0)={0x6239}, 0x4) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000000140)={{0x8, 0x8}, {0x5, 0x9}, 0x4, 0x4, 0x9}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000000)={{}, 0x0, 0x0, 0x0, {}, 0xffffffffffffffff}) getresuid(&(0x7f0000000100)=0x0, &(0x7f00000001c0), &(0x7f0000000280)) r4 = getegid() lstat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f00000003c0)=0x0, &(0x7f0000000400), &(0x7f0000000440)) write$FUSE_DIRENTPLUS(r2, &(0x7f0000000480)={0x158, 0xffffffffffffffda, 0x4, [{{0x2, 0x0, 0x8, 0xfffffffffffffffd, 0x8, 0x4, {0x3, 0x3, 0x100, 0x100000000, 0x3e9, 0x100000000, 0x2, 0xc96c, 0x7, 0x4, 0x9, r3, r4, 0xcf, 0x100000001}}, {0x2, 0xfff, 0x7, 0x0, 'bdev*%\f'}}, {{0x4, 0x0, 0x4, 0x1b1, 0xfa4, 0x8, {0x1, 0x6, 0x8, 0x6, 0x80000001, 0x6, 0xfffffffffffffffb, 0x9, 0x3, 0xfffffffffffffe92, 0x1, r5, r6, 0xffffffff, 0x5}}, {0x2, 0x48, 0xd, 0x2, '/dev/snd/seq\x00'}}]}, 0x158) openat$ion(0xffffffffffffff9c, &(0x7f0000000600)='/dev/ion\x00', 0x200000, 0x0) [ 477.676249] binder: 21654:21655 transaction failed 29201/-71, size 0-0 line 2741 [ 477.739472] binder: 21654:21655 ioctl c0306201 200001c0 returned -14 [ 477.752250] binder: BINDER_SET_CONTEXT_MGR already set [ 477.771370] binder: 21661:21666 ioctl 40046207 0 returned -16 12:01:29 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:29 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) 12:01:29 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x8]}}, 0x1c) [ 477.797146] binder_alloc: 21654: binder_alloc_buf failed to map pages in userspace, no vma [ 477.853429] binder_alloc: binder_alloc_mmap_handler: 21661 20001000-20004000 already mapped failed -16 [ 477.892341] binder: 21679:21680 ioctl c0306201 200001c0 returned -14 12:01:29 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) r1 = dup(r0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, &(0x7f0000000000)={0x6, 0x7, 0x91, 0xfffffffffffffff9, 'syz0\x00', 0x2}) syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x100000001, 0x2040) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) [ 477.898116] binder: BINDER_SET_CONTEXT_MGR already set [ 477.904270] binder: 21661:21666 ioctl 40046207 0 returned -16 12:01:29 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) 12:01:29 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0xed) [ 477.976398] binder_alloc: 21679: binder_alloc_buf failed to map pages in userspace, no vma 12:01:30 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xffffffffffffffff]}}, 0x1c) [ 478.038800] binder_release_work: 36 callbacks suppressed [ 478.038807] binder: undelivered TRANSACTION_ERROR: 29189 [ 478.067507] binder: undelivered TRANSACTION_ERROR: 29201 12:01:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce84ee9"}) 12:01:30 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x8001, 0x210400) ioctl$KDGETKEYCODE(r1, 0x4b4c, &(0x7f0000000040)={0xffffffffffff0001, 0x8}) [ 478.091545] XFS (loop3): Invalid superblock magic number [ 478.094106] binder: 21700:21706 ioctl c0306201 200001c0 returned -14 [ 478.124803] binder: undelivered TRANSACTION_ERROR: 29189 [ 478.161027] binder: undelivered TRANSACTION_ERROR: 29201 12:01:30 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) 12:01:30 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000002) 12:01:30 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x8dffffff00000000]}}, 0x1c) 12:01:30 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 478.244908] binder_alloc: binder_alloc_mmap_handler: 21718 20001000-20004000 already mapped failed -16 [ 478.256234] binder: BINDER_SET_CONTEXT_MGR already set [ 478.261604] binder: 21718:21722 ioctl 40046207 0 returned -16 [ 478.261614] binder: release 21718:21722 transaction 1243 out, still active [ 478.261625] binder: undelivered TRANSACTION_COMPLETE [ 478.269871] binder_alloc: 21718: binder_alloc_buf, no vma [ 478.305956] binder: undelivered TRANSACTION_ERROR: 29201 [ 478.335118] binder: send failed reply for transaction 1243, target dead 12:01:30 executing program 4: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000280)={0x0, 0x0, 0x3, 0x0, [], [{0x5879, 0x0, 0x81, 0xa5d, 0xc4}, {0xf800000000000000, 0xd114, 0x10001, 0xffa, 0x3, 0x8}], [[], [], []]}) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x4000) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x440300, 0x0) ioctl$PIO_FONT(r2, 0x4b61, &(0x7f0000000140)="a21d3506314253d0be5435f0ff2c87ebdd74c20f188bad67be7465ab9b55211a674fc6b3cad4f8312c8482c475ff94f98773f248e883f3965ae57cd334afbbffa9cc8937a165a2c2763c11112155ea2c26a8a3cb79c73e7002437a1ca2f794978ea4c8ad139189b93fc3c7ee06c2b455ce7d039457561073cad33dded99a72d2cea191550b6be9f85b5bd327c73779a5212281ff5d2158") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc0bc5351, &(0x7f0000000080)={{0x0, 0x80000000}, 0x0, 0x0, 0x400000}) [ 478.356184] binder: 21729:21731 ioctl c0306201 200001c0 returned -14 [ 478.363107] net_ratelimit: 4 callbacks suppressed [ 478.363117] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 478.389673] binder: undelivered TRANSACTION_ERROR: 29189 12:01:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce848e9"}) 12:01:30 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) [ 478.454738] binder: undelivered TRANSACTION_ERROR: 29201 12:01:30 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x20000000]}}, 0x1c) 12:01:30 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x40007a000000) [ 478.542769] XFS (loop3): Invalid superblock magic number [ 478.551834] binder_alloc: binder_alloc_mmap_handler: 21754 20001000-20004000 already mapped failed -16 [ 478.595144] binder: BINDER_SET_CONTEXT_MGR already set 12:01:30 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) [ 478.615812] binder: 21754:21758 ioctl 40046207 0 returned -16 [ 478.641254] binder: release 21754:21758 transaction 1249 out, still active [ 478.657549] binder: undelivered TRANSACTION_COMPLETE 12:01:30 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xffffffffffffffff]}}, 0x1c) [ 478.663320] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce84fe9"}) [ 478.734841] binder: undelivered TRANSACTION_ERROR: 29201 [ 478.740499] binder: undelivered TRANSACTION_ERROR: 29189 12:01:30 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x1663378b]}}, 0x1c) 12:01:30 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 478.799385] binder: undelivered TRANSACTION_ERROR: 29201 [ 478.813802] binder: send failed reply for transaction 1249, target dead 12:01:30 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) [ 478.869469] binder_transaction: 26 callbacks suppressed [ 478.869479] binder: 21784:21785 got reply transaction with no transaction stack 12:01:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) 12:01:30 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000100000) [ 479.019931] binder: BINDER_SET_CONTEXT_MGR already set 12:01:31 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xa]}}, 0x1c) 12:01:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) [ 479.042876] binder: 21784:21808 got reply transaction with no transaction stack [ 479.074774] binder: BINDER_SET_CONTEXT_MGR already set [ 479.096028] binder: 21802:21806 ioctl 40046207 0 returned -16 [ 479.106072] binder: 21784:21785 ioctl 40046207 0 returned -16 [ 479.137072] XFS (loop3): Invalid superblock magic number [ 479.143568] binder: 21815:21816 got reply transaction with no transaction stack [ 479.160064] binder: send failed reply for transaction 1254 to 21784:21785 [ 479.172858] binder: 21802:21806 got reply transaction with no transaction stack [ 479.173509] binder: 21815:21816 ioctl c0306201 200001c0 returned -14 12:01:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce838e9"}) 12:01:31 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000007a00) [ 479.226822] binder: 21802:21806 ioctl c0306201 200001c0 returned -14 [ 479.244586] binder: undelivered TRANSACTION_COMPLETE 12:01:31 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x1600000000000000]}}, 0x1c) 12:01:31 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs#', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:31 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=ANY=[@ANYBLOB="9015d6081ba3d350"], 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) getsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f0000000000)=""/33, &(0x7f0000000040)=0x21) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) 12:01:31 executing program 0: syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) [ 479.433277] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 479.454380] binder: 21838:21843 got reply transaction with no transaction stack [ 479.518452] binder: BINDER_SET_CONTEXT_MGR already set [ 479.546358] binder: 21838:21853 got reply transaction with no transaction stack 12:01:31 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x200000000000000]}}, 0x1c) 12:01:31 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000004) [ 479.576495] binder: 21838:21843 ioctl 40046207 0 returned -16 [ 479.616479] binder: release 21838:21843 transaction 1262 out, still active [ 479.639389] binder: undelivered TRANSACTION_COMPLETE 12:01:31 executing program 0: syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) 12:01:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce806e9"}) 12:01:31 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="786673ff", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 479.718379] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 479.780373] binder: send failed reply for transaction 1262, target dead 12:01:31 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400010000000) [ 479.852718] binder: 21868:21873 got reply transaction with no transaction stack 12:01:31 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xdc7f000000000000]}}, 0x1c) 12:01:31 executing program 0: syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) [ 479.929557] binder: BINDER_SET_CONTEXT_MGR already set [ 479.964071] binder: 21868:21873 ioctl 40046207 0 returned -16 [ 479.964663] binder: 21868:21884 got reply transaction with no transaction stack [ 480.019826] binder: release 21868:21873 transaction 1267 out, still active [ 480.044243] binder: undelivered TRANSACTION_COMPLETE 12:01:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce831e9"}) [ 480.100133] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:32 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) syz_mount_image$xfs(&(0x7f0000000140)='xfs\x00', &(0x7f0000000100)='./file0\x00', 0xffffffff, 0x1, &(0x7f0000000080)=[{&(0x7f00000002c0)="5846534200002e00000000000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000001000000000800000000000000081000000000000008200000001000010000000000100000000000006c0b4a40221010000100000000000000000000000000c0908040c22f86760427be9a3735b65bd9b3e53617c19d6df6772bc8bc016f1e66a993527af434bcbe3c9f2f80e965a4c719d66d4008b692aad5f417a8c4590b84b1944715e3d5fbe8d8d331fc2686c47", 0xc9}], 0x0, &(0x7f0000000040)) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000001c0)=@srh, 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000200), 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x9, @mcast1, 0x6}, 0x1c) 12:01:32 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000068) 12:01:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=ANY=[], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) 12:01:32 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x2000]}}, 0x1c) [ 480.204928] binder: send failed reply for transaction 1267, target dead 12:01:32 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="7866738c", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 480.287133] binder: 21895:21907 got reply transaction with no transaction stack [ 480.370647] binder_alloc_mmap_handler: 3 callbacks suppressed [ 480.370663] binder_alloc: binder_alloc_mmap_handler: 21895 20001000-20004000 already mapped failed -16 [ 480.410024] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 480.457921] binder: BINDER_SET_CONTEXT_MGR already set [ 480.458434] XFS (loop4): bad version [ 480.496288] binder: 21895:21907 ioctl 40046207 0 returned -16 12:01:32 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400002000000) [ 480.523780] XFS (loop4): SB validate failed with error -22. [ 480.541049] binder: 21895:21920 got reply transaction with no transaction stack 12:01:32 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xffffff91]}}, 0x1c) 12:01:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=ANY=[], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) [ 480.596211] binder_alloc_new_buf_locked: 4 callbacks suppressed [ 480.596221] binder_alloc: 21895: binder_alloc_buf, no vma [ 480.609282] binder: release 21895:21907 transaction 1272 out, still active 12:01:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=ANY=[], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) [ 480.734825] binder: send failed reply for transaction 1272, target dead 12:01:32 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce81ce9"}) 12:01:32 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xfffffff5]}}, 0x1c) [ 480.872350] binder_alloc: binder_alloc_mmap_handler: 21958 20001000-20004000 already mapped failed -16 [ 480.905969] binder: BINDER_SET_CONTEXT_MGR already set [ 480.958901] binder: 21958:21959 ioctl 40046207 0 returned -16 [ 480.980899] binder: release 21958:21959 transaction 1277 out, still active [ 480.991706] binder_release_work: 1 callbacks suppressed [ 480.991725] binder: undelivered TRANSACTION_COMPLETE [ 481.043190] XFS (loop3): Invalid superblock magic number 12:01:33 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) 12:01:33 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x40004c000000) 12:01:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) 12:01:33 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x2]}}, 0x1c) 12:01:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce80ce9"}) [ 481.085198] binder: send failed reply for transaction 1277, target dead [ 481.168660] binder_alloc: binder_alloc_mmap_handler: 21992 20001000-20004000 already mapped failed -16 [ 481.178441] binder: BINDER_SET_CONTEXT_MGR already set [ 481.183822] binder: 21992:21999 ioctl 40046207 0 returned -16 [ 481.192246] binder_alloc: 21992: binder_alloc_buf, no vma [ 481.211963] binder: release 21992:21999 transaction 1281 out, still active 12:01:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) 12:01:33 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x8000000000000000]}}, 0x1c) 12:01:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce827e9"}) 12:01:33 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:33 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400005000000) [ 481.233799] binder: undelivered TRANSACTION_COMPLETE [ 481.314686] binder: send failed reply for transaction 1281, target dead 12:01:33 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000080)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) [ 481.370043] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 481.370493] binder_alloc: binder_alloc_mmap_handler: 22016 20001000-20004000 already mapped failed -16 12:01:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) 12:01:33 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x54]}}, 0x1c) [ 481.451572] XFS (loop3): Invalid superblock magic number [ 481.478975] binder: BINDER_SET_CONTEXT_MGR already set [ 481.499890] binder: 22016:22021 ioctl 40046207 0 returned -16 12:01:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="1263"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) [ 481.532476] binder_alloc: 22016: binder_alloc_buf, no vma 12:01:33 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x4000f5ffffff) 12:01:33 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0xc0fe}, 0x1c) [ 481.574218] binder: release 22016:22021 transaction 1286 out, still active [ 481.587814] binder: undelivered TRANSACTION_COMPLETE 12:01:33 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xe000000]}}, 0x1c) 12:01:33 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667301", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce821e9"}) [ 481.639164] binder: 22056:22058 unknown command 25362 [ 481.658574] binder: 22056:22058 ioctl c0306201 200001c0 returned -22 12:01:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="1263"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) [ 481.702140] binder: send failed reply for transaction 1286, target dead [ 481.707635] binder_alloc: binder_alloc_mmap_handler: 22061 20001000-20004000 already mapped failed -16 [ 481.739651] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 481.778539] binder: BINDER_SET_CONTEXT_MGR already set [ 481.782537] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:33 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x4000fffffff5) 12:01:33 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x10ad}, 0xffffffffffffff99) bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x6, 0x5, &(0x7f0000346fc8)=ANY=[@ANYBLOB="180000001000000061100800000000b48ee4044bb600000000000000000095000000000000000000"], &(0x7f0000f6bffb)='GPL\x00', 0x1, 0x3bc, &(0x7f00001a7f05)=""/251}, 0x57) [ 481.823490] binder: 22074:22076 unknown command 25362 [ 481.825613] binder: 22061:22062 ioctl 40046207 0 returned -16 [ 481.848481] binder: 22074:22076 ioctl c0306201 200001c0 returned -22 12:01:33 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x54000000]}}, 0x1c) [ 481.919015] binder_alloc: 22061: binder_alloc_buf, no vma [ 481.939038] binder_transaction: 37 callbacks suppressed [ 481.939055] binder: 22061:22086 transaction failed 29201/-71, size 0-0 line 2741 12:01:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="1263"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) 12:01:34 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/sockstat\x00') mknodat(r1, &(0x7f0000000080)='./file0\x00', 0x1000, 0x9) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000140)={{0x0, 0x9adc}, 'port1\x00', 0x8, 0x20, 0xc6dd, 0x200, 0xc0cd1e6, 0x225e, 0xffffffff, 0x0, 0x7, 0x603}) getsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000000c0), &(0x7f0000000200)=0x8) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) set_mempolicy(0x4003, &(0x7f0000000040)=0xfffffffffffffffd, 0x3f) [ 481.986125] binder: release 22061:22062 transaction 1291 out, still active [ 481.993205] binder: undelivered TRANSACTION_COMPLETE [ 481.994728] binder: 22061:22066 transaction failed 29189/-3, size 0-0 line 2973 [ 482.022972] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 482.061090] binder: 22098:22099 unknown command 25362 12:01:34 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xff00]}}, 0x1c) 12:01:34 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667316", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce836e9"}) [ 482.094302] binder: 22098:22099 ioctl c0306201 200001c0 returned -22 [ 482.104687] binder: send failed reply for transaction 1291, target dead 12:01:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x3, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) 12:01:34 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000009) 12:01:34 executing program 4: r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0xe440, 0x1) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000000)={0x0, 0x0, 0x800}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x2000, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x10000, 0x0) ioctl$IOC_PR_RESERVE(r2, 0x401070c9, &(0x7f0000000100)={0x6, 0x6}) ioctl$KDADDIO(r1, 0x4b34, 0x80) [ 482.236055] binder: 22107:22110 transaction failed 29201/-71, size 0-0 line 2741 [ 482.281813] binder: 22122:22123 unknown command 4743954 [ 482.289669] binder_alloc: binder_alloc_mmap_handler: 22107 20001000-20004000 already mapped failed -16 [ 482.311346] binder: BINDER_SET_CONTEXT_MGR already set [ 482.321754] binder: 22107:22125 transaction failed 29201/-71, size 0-0 line 2741 12:01:34 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xff0f]}}, 0x1c) [ 482.329954] binder: 22107:22110 ioctl 40046207 0 returned -16 [ 482.336518] binder: 22122:22123 ioctl c0306201 200001c0 returned -22 [ 482.342694] binder_alloc: 22107: binder_alloc_buf, no vma [ 482.347472] binder: release 22107:22110 transaction 1296 out, still active [ 482.366157] binder: undelivered TRANSACTION_COMPLETE 12:01:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x3, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) 12:01:34 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000074) [ 482.406828] binder: 22107:22115 transaction failed 29189/-3, size 0-0 line 2973 [ 482.444796] binder: send failed reply for transaction 1296, target dead 12:01:34 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs.', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce812e9"}) 12:01:34 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xfec0]}}, 0x1c) [ 482.513250] binder: 22143:22144 unknown command 4743954 [ 482.542807] binder: 22143:22144 ioctl c0306201 200001c0 returned -22 12:01:34 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhost-net\x00', 0x2, 0x0) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000000c0), 0xc, &(0x7f00000005c0)={&(0x7f0000000640)=ANY=[]}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x42, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f0000000000)={0x4000000000000000, 0x4, 0x7, 0x4, 0x1d}) ioctl$KVM_PPC_ALLOCATE_HTAB(r1, 0x4008af03, &(0x7f0000000100)=0x40) fdatasync(r0) ioctl$VHOST_RESET_OWNER(r0, 0xaf02, 0x0) 12:01:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x3, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348"], 0x4, 0x2000000, &(0x7f0000000480)="bce854e9"}) [ 482.615369] binder: 22153:22155 transaction failed 29201/-71, size 0-0 line 2741 [ 482.652585] binder_alloc: binder_alloc_mmap_handler: 22153 20001000-20004000 already mapped failed -16 [ 482.687516] binder: BINDER_SET_CONTEXT_MGR already set 12:01:34 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 482.720929] binder: 22153:22155 ioctl 40046207 0 returned -16 [ 482.742031] binder: 22169:22170 unknown command 4743954 [ 482.764797] binder: 22169:22170 ioctl c0306201 200001c0 returned -22 12:01:34 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x40000000007a) 12:01:34 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x4]}}, 0x1c) [ 482.771447] binder_alloc: 22153: binder_alloc_buf, no vma [ 482.831359] binder: 22153:22172 transaction failed 29189/-3, size 0-0 line 2973 12:01:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x0, 0x2000000, &(0x7f0000000480)}) 12:01:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce853e9"}) 12:01:34 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhost-net\x00', 0x2, 0x0) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000000c0), 0xc, &(0x7f00000005c0)={&(0x7f0000000640)=ANY=[]}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x42, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f0000000000)={0x4000000000000000, 0x4, 0x7, 0x4, 0x1d}) ioctl$KVM_PPC_ALLOCATE_HTAB(r1, 0x4008af03, &(0x7f0000000100)=0x40) fdatasync(r0) ioctl$VHOST_RESET_OWNER(r0, 0xaf02, 0x0) [ 482.895190] binder: send failed reply for transaction 1301 to 22153:22155 [ 482.902935] binder: undelivered TRANSACTION_COMPLETE 12:01:34 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xfec0000000000000]}}, 0x1c) [ 482.947017] XFS (loop3): Invalid superblock magic number [ 482.983523] binder: 22202:22203 transaction failed 29201/-71, size 0-0 line 2741 [ 483.007505] binder: 22204:22208 transaction failed 29201/-71, size 0-0 line 2741 [ 483.037351] binder_alloc: binder_alloc_mmap_handler: 22202 20001000-20004000 already mapped failed -16 12:01:35 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400006000000) [ 483.065481] binder: BINDER_SET_CONTEXT_MGR already set 12:01:35 executing program 4: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400100401000200027000f8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) fchdir(r0) setxattr$security_selinux(&(0x7f0000000080)='./file2\x00', &(0x7f00000001c0)='security.selinux\x00', &(0x7f0000000200)='system_u:object_r:login_exec_t:s0\x00', 0x22, 0x1) open(&(0x7f0000000040)='./file1\x00', 0x40, 0x0) write$P9_RREADLINK(r0, &(0x7f0000000000)={0x10, 0x17, 0x1, {0x7, './file2'}}, 0x10) renameat2(r0, &(0x7f00000000c0)='./file1\x00', r0, &(0x7f0000000180)='./file2\x00', 0x0) 12:01:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x0, 0x2000000, &(0x7f0000000480)}) [ 483.099514] binder: 22202:22203 ioctl 40046207 0 returned -16 [ 483.103600] binder_release_work: 31 callbacks suppressed [ 483.103608] binder: undelivered TRANSACTION_ERROR: 29201 [ 483.108905] binder_alloc: 22202: binder_alloc_buf, no vma [ 483.124728] binder: 22202:22224 transaction failed 29201/-71, size 0-0 line 2741 12:01:35 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:35 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xfc00000000000000]}}, 0x1c) [ 483.155154] binder: undelivered TRANSACTION_ERROR: 29189 12:01:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce80fe9"}) [ 483.213334] binder: undelivered TRANSACTION_ERROR: 29201 [ 483.254653] binder: undelivered TRANSACTION_ERROR: 29201 [ 483.260173] binder: send failed reply for transaction 1305 to 22202:22203 12:01:35 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000006800) 12:01:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x0, 0x2000000, &(0x7f0000000480)}) 12:01:35 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = dup(r0) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f0000000000)={0x2, 0x1ff}) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={&(0x7f0000000080), 0xc, &(0x7f0000000540)={&(0x7f00000003c0)=@updpolicy={0xc4, 0x19, 0x209, 0x0, 0x0, {{@in6=@dev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa}}, [@mark={0xc}]}, 0xc4}}, 0x0) [ 483.339352] binder: undelivered TRANSACTION_ERROR: 29201 [ 483.371621] binder: undelivered TRANSACTION_COMPLETE [ 483.390010] binder_alloc: binder_alloc_mmap_handler: 22249 20001000-20004000 already mapped failed -16 [ 483.402730] binder: undelivered TRANSACTION_ERROR: 29189 [ 483.419589] XFS (loop3): Invalid superblock magic number 12:01:35 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x300]}}, 0x1c) [ 483.442465] binder: BINDER_SET_CONTEXT_MGR already set [ 483.455028] binder: 22249:22253 ioctl 40046207 0 returned -16 [ 483.465133] binder: undelivered TRANSACTION_ERROR: 29201 12:01:35 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x40000000004c) 12:01:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x2, 0x2000000, &(0x7f0000000480)="bce8"}) [ 483.500646] binder: undelivered TRANSACTION_ERROR: 29201 [ 483.569760] net_ratelimit: 3 callbacks suppressed [ 483.569771] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 483.595303] binder: undelivered TRANSACTION_ERROR: 29201 [ 483.600834] binder: send failed reply for transaction 1312 to 22249:22253 12:01:35 executing program 4: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x60280, 0x0) ioctl$KVM_GET_XCRS(r0, 0x8188aea6, &(0x7f0000000040)={0x1, 0x9, [{0x1, 0x0, 0x200}]}) write$apparmor_exec(r0, &(0x7f0000000080)={'exec ', '/dev/null\x00'}, 0xf) write$FUSE_OPEN(r0, &(0x7f00000000c0)={0x20, 0xffffffffffffffda, 0x1, {0x0, 0x1}}, 0x20) setsockopt$RDS_RECVERR(r0, 0x114, 0x5, &(0x7f0000000100)=0x1, 0x4) acct(&(0x7f0000000140)='./file0\x00') ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000180)=""/20) sendmsg$nl_route(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0xcc422441c718454a}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=@ipmr_getroute={0x1c, 0x1a, 0x621, 0x70bd2d, 0x25dfdbff, {0x80, 0xb4, 0x14, 0x1000, 0x0, 0x6, 0x0, 0xd, 0x3600}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x40005) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f00000002c0)={0x0, 0x7}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000340)={r1, 0x100000001}, &(0x7f0000000380)=0x8) ioctl$TCSBRK(r0, 0x5409, 0x9) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000003c0)={0x1ff, 0x2, 0xb000}, 0x4) lremovexattr(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)=@known='system.posix_acl_default\x00') ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000480)=""/75) r3 = socket$kcm(0x29, 0x5, 0x0) ioctl$BLKSECDISCARD(r0, 0x127d, &(0x7f0000000500)) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000540)={&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x4000, 0x1}) ioctl$sock_SIOCOUTQNSD(r3, 0x894b, &(0x7f0000000580)) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000640)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000600)={0xffffffffffffffff}, 0x111, 0x1000}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f0000000680)={0x12, 0x10, 0xfa00, {&(0x7f00000005c0), r4, r0}}, 0x18) write$cgroup_type(r0, &(0x7f00000006c0)='threaded\x00', 0x9) clock_gettime(0x0, &(0x7f0000000740)={0x0, 0x0}) ppoll(&(0x7f0000000700)=[{r3, 0x200}, {r0, 0x200}, {r0, 0x2}, {r0, 0x1000}, {r0, 0x100}, {r3, 0x508}, {r3, 0x80}], 0x7, &(0x7f0000000780)={r5, r6+30000000}, &(0x7f00000007c0)={0x3}, 0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000800)=@sack_info={r2, 0x8001, 0x9}, 0xc) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r0, 0xc10c5541, &(0x7f0000000840)={0x0, 0x101, 0x4, 0x0, 0x0, [], [], [], 0xfffffffffffffff7, 0xeb}) fstatfs(r0, &(0x7f0000000980)=""/94) getsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000a00)=0x2, &(0x7f0000000a40)=0x2) connect$unix(r0, &(0x7f0000000a80)=@file={0x0, './file0\x00'}, 0x6e) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000b00)={0x5, {{0x2, 0x4e21, @loopback}}}, 0x88) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000bc0)={0x10000010}) [ 483.634432] binder: undelivered TRANSACTION_COMPLETE 12:01:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce817e9"}) 12:01:35 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:35 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x40020000]}}, 0x1c) [ 483.656690] binder: undelivered TRANSACTION_ERROR: 29189 [ 483.672421] binder: 22288:22289 ioctl c0306201 200001c0 returned -14 12:01:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x0, 0x2000000, &(0x7f0000000480)}) 12:01:35 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000048) [ 483.775680] binder_alloc: binder_alloc_mmap_handler: 22295 20001000-20004000 already mapped failed -16 12:01:35 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = socket(0x9, 0x80000, 0xff) bind$inet6(r0, &(0x7f00004c0000)={0xa, 0x3, 0x0, @ipv4}, 0x1c) listen(r0, 0x43) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000080)=0x7fff, 0x4) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f00000000c0)={'raw\x00', 0xd3, "e030e90f0117f6f89f45f93c0069a1e1264b7b5ed8670744dc515289bae6359b41f9b4ace916fbaefbaae319a8ac5439d96e587561c1688a072224095fd1cd20c5feefbbe64c5b2dbdbf14a61e5419b7d52b5c6fb29fc3279822d1a2792fe8fb3040789c4a7a5042c154330613e9d9f9304f55866b7849b667338330ad3185a20324aeb86fa4452ee51d371d8d3ffcaaa38e5214b27589d2efae6d6f2d97c56ab194fefd41fb0a50a4804266d637f288d07038197ed2aa30443b98bc0c371d253ca5320d86fdaa0ab042abe5b4a0927cefe5fc"}, &(0x7f0000000000)=0xf7) ioctl$LOOP_SET_FD(r0, 0x4c00, r2) sendto$inet6(r2, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x3, 0x0, @loopback}, 0x1c) [ 483.847700] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 483.870518] binder: BINDER_SET_CONTEXT_MGR already set [ 483.889387] binder_transaction: 20 callbacks suppressed 12:01:35 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x10000000]}}, 0x1c) [ 483.889396] binder: 22308:22313 got reply transaction with no transaction stack [ 483.890922] binder: 22295:22300 ioctl 40046207 0 returned -16 [ 483.951124] binder_alloc: 22295: binder_alloc_buf, no vma [ 483.966512] binder: 22295:22324 got reply transaction with no transaction stack [ 483.984107] binder: release 22295:22300 transaction 1318 out, still active 12:01:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x0, 0x2000000, &(0x7f0000000480)}) 12:01:36 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x40007ffff000) 12:01:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce834e9"}) [ 483.993512] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 484.007169] binder: undelivered TRANSACTION_COMPLETE [ 484.036695] XFS (loop3): Invalid superblock magic number 12:01:36 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x4000]}}, 0x1c) [ 484.117194] binder: 22337:22340 got reply transaction with no transaction stack [ 484.142001] binder: 22339:22342 got reply transaction with no transaction stack [ 484.144655] binder: send failed reply for transaction 1318, target dead [ 484.202295] binder: BINDER_SET_CONTEXT_MGR already set [ 484.203368] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 484.236428] binder: 22339:22357 got reply transaction with no transaction stack [ 484.246407] binder_alloc: 22339: binder_alloc_buf, no vma 12:01:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x0, 0x2000000, &(0x7f0000000480)}) 12:01:36 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:36 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xed5596ea]}}, 0x1c) [ 484.262211] binder: 22339:22342 ioctl 40046207 0 returned -16 [ 484.277880] binder: release 22339:22342 transaction 1325 out, still active [ 484.297580] binder: undelivered TRANSACTION_COMPLETE 12:01:36 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400004000000) [ 484.331108] binder: 22360:22361 got reply transaction with no transaction stack 12:01:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce852e9"}) [ 484.399474] binder: send failed reply for transaction 1325, target dead 12:01:36 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0xfffffffffffffffd) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000040)={0x2, r3, 0x1}) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000001ac0)={0x7b, 0x0, [0x1b, 0xdfff]}) 12:01:36 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x500]}}, 0x1c) [ 484.515168] binder: 22384:22386 got reply transaction with no transaction stack [ 484.534597] XFS (loop3): Invalid superblock magic number [ 484.565320] binder: 22384:22386 ioctl c0306201 200001c0 returned -14 [ 484.565759] binder: 22377:22392 got reply transaction with no transaction stack 12:01:36 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400001000000) 12:01:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x0, 0x2000000, &(0x7f0000000480)}) [ 484.613016] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 484.638856] binder: BINDER_SET_CONTEXT_MGR already set 12:01:36 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = gettid() r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x20000, 0x0) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000100)=@assoc_id=0x0, &(0x7f0000000140)=0x4) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000200)={0x80000001, 0x52, 0x200, 0x0, 0x5, 0x8001, 0x81, 0x2, r3}, &(0x7f0000000240)=0x20) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f00000000c0)=r1) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000000), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000ad6fad)='s', 0x1, 0x3fffffd, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 12:01:36 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x4002000000000000]}}, 0x1c) 12:01:36 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce83de9"}) [ 484.667241] binder: 22377:22402 got reply transaction with no transaction stack [ 484.667384] binder: 22377:22392 ioctl 40046207 0 returned -16 [ 484.684938] binder_alloc: 22377: binder_alloc_buf, no vma [ 484.693688] binder: release 22377:22392 transaction 1332 out, still active [ 484.774683] binder: send failed reply for transaction 1332, target dead [ 484.777952] binder: 22412:22417 got reply transaction with no transaction stack [ 484.806506] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 484.899156] binder: BINDER_SET_CONTEXT_MGR already set [ 484.910383] binder: release 22420:22427 transaction 1338 out, still active [ 484.923283] binder: 22420:22427 ioctl 40046207 0 returned -16 12:01:36 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000f6bfe8)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="8bc5247ab65d42088fd0510fe0b5057f78889e04b415fc505fc2faf5760e864dcf7dbbaed49802f49e1e252e2db6b3ea0680278e56730da4f2827581f83f8ffb4ace8aec707461d6560df4162ee515a40000000000000000000000000000"], 0x1}}, 0x0) semget(0xffffffffffffffff, 0x1, 0x0) mkdir(&(0x7f0000000300)='./file0//ile0\x00', 0x0) syz_open_dev$adsp(&(0x7f00000000c0)='/dev/adsp#\x00', 0x0, 0x40040) ioctl$UFFDIO_REGISTER(r0, 0xc028aa03, &(0x7f00000a0fe0)={{&(0x7f00005e3000/0x800000)=nil, 0x730000}}) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socketpair$inet6(0xa, 0x1, 0x2, &(0x7f0000000640)) read$FUSE(r1, &(0x7f0000001000), 0x1000) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x0, 0x0) 12:01:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x0, 0x2000000, &(0x7f0000000480)}) 12:01:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce80be9"}) 12:01:36 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000f0ff7f) [ 484.954726] binder: send failed reply for transaction 1338, target dead 12:01:36 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x8000000]}}, 0x1c) [ 485.009274] XFS (loop3): Invalid superblock magic number 12:01:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x0, 0x2000000, &(0x7f0000000480)}) [ 485.124480] binder: BINDER_SET_CONTEXT_MGR already set [ 485.137530] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 485.161538] binder: release 22449:22454 transaction 1344 out, still active 12:01:37 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x3e8]}}, 0x1c) [ 485.172890] binder: 22449:22454 ioctl 40046207 0 returned -16 [ 485.215315] binder: send failed reply for transaction 1344, target dead 12:01:37 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:37 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000700) 12:01:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce847e9"}) 12:01:37 executing program 0 (fault-call:1 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:37 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x5]}}, 0x1c) [ 485.410427] binder_alloc_mmap_handler: 4 callbacks suppressed [ 485.410444] binder_alloc: binder_alloc_mmap_handler: 22483 20001000-20004000 already mapped failed -16 12:01:37 executing program 4: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x20600, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x100000000002, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0x8ec0, 0x0) [ 485.465184] FAULT_INJECTION: forcing a failure. [ 485.465184] name failslab, interval 1, probability 0, space 0, times 0 [ 485.491313] binder: BINDER_SET_CONTEXT_MGR already set [ 485.500866] binder: 22483:22488 ioctl 40046207 0 returned -16 [ 485.537843] CPU: 0 PID: 22499 Comm: syz-executor0 Not tainted 4.19.0-rc8-next-20181016+ #95 [ 485.546409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 485.555808] Call Trace: [ 485.558420] dump_stack+0x244/0x39d [ 485.562071] ? dump_stack_print_info.cold.1+0x20/0x20 [ 485.567300] should_fail.cold.4+0xa/0x17 [ 485.571401] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 485.576644] ? print_usage_bug+0xc0/0xc0 [ 485.580760] ? zap_class+0x640/0x640 [ 485.584502] ? find_held_lock+0x36/0x1c0 [ 485.588609] ? perf_trace_sched_process_exec+0x860/0x860 [ 485.594110] __should_failslab+0x124/0x180 [ 485.598370] should_failslab+0x9/0x14 [ 485.602186] kmem_cache_alloc_trace+0x2d7/0x750 [ 485.606876] ? _raw_spin_unlock+0x2c/0x50 [ 485.611114] binder_get_thread+0x255/0x880 [ 485.615366] ? binder_new_node+0x8d0/0x8d0 [ 485.619614] ? perf_trace_sched_process_exec+0x860/0x860 [ 485.625071] ? rcu_lockdep_current_cpu_online+0x1a4/0x210 [ 485.630617] ? rcu_pm_notify+0xc0/0xc0 [ 485.634521] ? __might_sleep+0x95/0x190 [ 485.638519] ? binder_ioctl_write_read.isra.42+0xb90/0xb90 [ 485.644201] binder_ioctl+0x270/0x1940 [ 485.648114] ? binder_ioctl_write_read.isra.42+0xb90/0xb90 [ 485.653742] ? find_held_lock+0x36/0x1c0 [ 485.657819] ? __fget+0x4aa/0x740 [ 485.661285] ? lock_downgrade+0x900/0x900 [ 485.665447] ? check_preemption_disabled+0x48/0x280 [ 485.670479] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 485.675429] ? kasan_check_read+0x11/0x20 [ 485.679589] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 485.684877] ? rcu_softirq_qs+0x20/0x20 [ 485.688883] ? __fget+0x4d1/0x740 [ 485.692377] ? ksys_dup3+0x680/0x680 [ 485.696122] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 485.701072] ? binder_ioctl_write_read.isra.42+0xb90/0xb90 [ 485.706704] do_vfs_ioctl+0x1de/0x1720 [ 485.710603] ? __lock_is_held+0xb5/0x140 [ 485.714673] ? ioctl_preallocate+0x300/0x300 [ 485.719090] ? __fget_light+0x2e9/0x430 [ 485.723075] ? fget_raw+0x20/0x20 [ 485.726540] ? __sb_end_write+0xd9/0x110 [ 485.730613] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 485.736153] ? fput+0x130/0x1a0 [ 485.739463] ? do_syscall_64+0x9a/0x820 [ 485.743458] ? do_syscall_64+0x9a/0x820 [ 485.747447] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 485.752043] ? security_file_ioctl+0x94/0xc0 [ 485.756467] ksys_ioctl+0xa9/0xd0 [ 485.759931] __x64_sys_ioctl+0x73/0xb0 [ 485.763839] do_syscall_64+0x1b9/0x820 [ 485.767730] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 485.773123] ? syscall_return_slowpath+0x5e0/0x5e0 [ 485.778060] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 485.782918] ? trace_hardirqs_on_caller+0x310/0x310 [ 485.787958] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 485.792989] ? prepare_exit_to_usermode+0x291/0x3b0 [ 485.798044] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 485.802910] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 485.808116] RIP: 0033:0x457569 [ 485.811329] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 485.830261] RSP: 002b:00007f5e2956fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 12:01:37 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000005) 12:01:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce82ce9"}) [ 485.837982] RAX: ffffffffffffffda RBX: 00007f5e2956fc90 RCX: 0000000000457569 [ 485.845253] RDX: 00000000200001c0 RSI: 00000000c0306201 RDI: 0000000000000003 [ 485.852561] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 485.859861] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5e295706d4 [ 485.867133] R13: 00000000004be858 R14: 00000000004ce4d0 R15: 0000000000000004 12:01:37 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x400000000000000]}}, 0x1c) [ 485.901010] XFS (loop3): Invalid superblock magic number [ 485.951866] binder_alloc: binder_alloc_mmap_handler: 22518 20001000-20004000 already mapped failed -16 [ 485.962038] binder: 22496:22499 ioctl c0306201 200001c0 returned -12 [ 485.994964] binder: BINDER_SET_CONTEXT_MGR already set 12:01:38 executing program 0 (fault-call:1 fault-nth:1): r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 486.015907] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 486.034706] binder: 22518:22519 ioctl 40046207 0 returned -16 12:01:38 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x40007fffefe1) 12:01:38 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x2000000000000000]}}, 0x1c) [ 486.064063] binder_alloc_new_buf_locked: 3 callbacks suppressed [ 486.064072] binder_alloc: 22518: binder_alloc_buf, no vma [ 486.081643] binder_thread_release: 1 callbacks suppressed [ 486.081653] binder: release 22518:22519 transaction 1355 out, still active 12:01:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce805e9"}) 12:01:38 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:38 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="b7f2288a911993f0265df5cf1cdd06d692f130088866528b55b062950b86bc01", 0x20) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000), 0x0, &(0x7f0000000140)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[], 0xffffffaa) recvmmsg(r1, &(0x7f0000005a00)=[{{&(0x7f0000001bc0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000001e00)=[{&(0x7f0000001c40)=""/180, 0x7ffff000}], 0x1, &(0x7f0000001e40)=""/213, 0xd5}}], 0x400002d, 0x0, &(0x7f0000005c00)={0x77359400}) [ 486.114811] binder_release_work: 4 callbacks suppressed [ 486.114817] binder: undelivered TRANSACTION_COMPLETE [ 486.204817] binder_send_failed_reply: 1 callbacks suppressed [ 486.204825] binder: send failed reply for transaction 1355, target dead [ 486.208306] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:38 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_WKALM_RD(r0, 0x80287010, &(0x7f0000000280)) [ 486.281848] binder: 22542:22551 ioctl c0306201 200001c0 returned -14 [ 486.298764] binder_alloc: binder_alloc_mmap_handler: 22544 20001000-20004000 already mapped failed -16 12:01:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 486.343161] binder: BINDER_SET_CONTEXT_MGR already set 12:01:38 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xfec00000]}}, 0x1c) [ 486.375517] binder: 22544:22545 ioctl 40046207 0 returned -16 [ 486.399624] binder_alloc: 22544: binder_alloc_buf, no vma [ 486.408478] XFS (loop3): Invalid superblock magic number 12:01:38 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') shmget$private(0x0, 0x3000, 0x127, &(0x7f0000ffa000/0x3000)=nil) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000040)={r1}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 486.421843] binder: release 22544:22545 transaction 1361 out, still active [ 486.437496] binder: undelivered TRANSACTION_COMPLETE [ 486.442909] binder: 22568:22570 ioctl c0306201 200001c0 returned -14 [ 486.462654] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce808e9"}) 12:01:38 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00001ec000), 0x0) 12:01:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 486.536076] binder: send failed reply for transaction 1361, target dead 12:01:38 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x1802]}}, 0x1c) 12:01:38 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:38 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x1ff, 0x400) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f00000000c0)=0x9, 0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 486.601773] binder_alloc: binder_alloc_mmap_handler: 22584 20001000-20004000 already mapped failed -16 [ 486.634030] binder: BINDER_SET_CONTEXT_MGR already set [ 486.678026] binder_alloc: 22584: binder_alloc_buf, no vma 12:01:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 486.719451] binder: release 22584:22585 transaction 1367 out, still active [ 486.727097] binder: 22584:22585 ioctl 40046207 0 returned -16 [ 486.737902] binder: undelivered TRANSACTION_COMPLETE 12:01:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce837e9"}) 12:01:38 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x5bb42]}}, 0x1c) [ 486.804717] binder: send failed reply for transaction 1367, target dead 12:01:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 486.884452] XFS (loop3): Invalid superblock magic number 12:01:38 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400218) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000080)="b7f2288a911993f0265df5cf1cdd06d6", 0x10) 12:01:38 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x40000, 0x0) ftruncate(r0, 0x311043e0) recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f00000000c0)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1c3, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0xfffffffffffffffc, &(0x7f0000000080)={0x77359400}) r1 = getpgid(0x0) r2 = syz_open_procfs(r1, &(0x7f0000000380)="6e65746a03b482212434709e1f62f715fed98f49cbfa3a04f68d47b2469dbccdbe7ed70ab269600bee27d263e447c960ec04e40a756400000000000000000000000000000000145e361908d49583afb5171d603a9bd48039ac1e784e4b21bd13e280b1daf4919de8ebd1fe28044aa8e72300d151e003587abce4e3dbc9a74993fe3d11d7fa3fe7f8cce7836e0ba5c4b40000000000000e4e6d448848deb1436e18e99fc15eca7375e731e7b7e3b6835b965b6379c995446c5d1e99149939e6664a6f97896aadab316078224ee4b068799d60119504ca9e0d66b7f826c527cc49c85989d344cb5483eb9a3d99fa5ad0b615bb9e28de5adf9832efeee999a9a4ed37336a41ceebc938cd543cc02617e138b291c24617b9") socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r2, &(0x7f00000017c0), 0x1fe, 0x400000000000) ioctl$KVM_ASSIGN_SET_MSIX_NR(r2, 0x4008ae73, &(0x7f0000000040)={0x7, 0x400000}) [ 486.989799] binder_transaction: 42 callbacks suppressed [ 486.989815] binder: 22630:22632 transaction failed 29201/-71, size 0-0 line 2741 12:01:39 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xffffff8d]}}, 0x1c) 12:01:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306248, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 487.033067] binder_alloc: binder_alloc_mmap_handler: 22630 20001000-20004000 already mapped failed -16 [ 487.065518] binder_alloc: 22630: binder_alloc_buf, no vma [ 487.072182] binder: 22630:22644 transaction failed 29189/-3, size 0-0 line 2973 12:01:39 executing program 4: userfaultfd(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001cf, 0x0) 12:01:39 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 487.074917] binder: BINDER_SET_CONTEXT_MGR already set [ 487.082898] binder: 22630:22647 transaction failed 29201/-71, size 0-0 line 2741 [ 487.090380] binder: 22630:22632 ioctl 40046207 0 returned -16 [ 487.099757] binder: release 22630:22632 transaction 1372 out, still active [ 487.119359] binder: undelivered TRANSACTION_COMPLETE 12:01:39 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) ioctl$int_in(r1, 0x5452, &(0x7f0000000040)=0x5) [ 487.155425] binder: 22648:22649 ioctl c0306248 200001c0 returned -22 12:01:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce83ce9"}) 12:01:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306204, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 487.244701] binder: send failed reply for transaction 1372, target dead 12:01:39 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x1802000000000000]}}, 0x1c) [ 487.330595] XFS (loop3): Invalid superblock magic number [ 487.366965] binder: 22675:22678 transaction failed 29201/-71, size 0-0 line 2741 12:01:39 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfst', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 487.395417] binder: 22679:22685 ioctl c0306204 200001c0 returned -22 [ 487.423043] binder_alloc: binder_alloc_mmap_handler: 22675 20001000-20004000 already mapped failed -16 12:01:39 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/udp6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f0000000000)={0x3, 0x70, 0x7, 0x5, 0x1, 0x8, 0x0, 0x7, 0x3000, 0xe, 0x1ff, 0x59, 0x44, 0x7, 0x100, 0x10000, 0x8000, 0x9, 0x3f, 0x0, 0x40, 0xfffffffffffffffc, 0x1d1a1349, 0xffffffffffff8001, 0xfffffffffffffff9, 0x64, 0x8, 0x7, 0x7ff, 0x800000000, 0x2, 0x7, 0x2, 0x7, 0x7, 0x35b, 0x8d5, 0x3, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x8001}, 0x8600, 0x8, 0x2000000000000000, 0x7, 0x8, 0x6, 0x9}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x80045700, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:01:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:39 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xa00000000000000]}}, 0x1c) [ 487.498618] binder: BINDER_SET_CONTEXT_MGR already set [ 487.526632] binder: 22675:22678 ioctl 40046207 0 returned -16 [ 487.572798] binder: 22675:22688 transaction failed 29201/-71, size 0-0 line 2741 12:01:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce819e9"}) [ 487.623456] binder: release 22675:22678 transaction 1377 out, still active [ 487.631917] binder: undelivered TRANSACTION_COMPLETE 12:01:39 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x408000, 0x0) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000600)={0x7, &(0x7f00000005c0)=[{}, {}, {}, {}, {}, {}, {}]}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, r0, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r1, 0x40000000af01, &(0x7f0000c97ff8)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000500)=0x0) migrate_pages(r2, 0x6, &(0x7f0000000540)=0x8000, &(0x7f0000000580)=0x3) write$FUSE_GETXATTR(r0, &(0x7f0000000080)={0x18, 0xfffffffffffffffe, 0x2, {0x8}}, 0x18) getsockopt$ARPT_SO_GET_ENTRIES(r0, 0x0, 0x61, &(0x7f00000003c0)={'filter\x00', 0xb3, "72070d8ab3aec0c3b051bb69b9b74fd4a5d9764737c4ae37f6566f981b170b281c930e38e234b9ca545e7c684d257f596fde2023ab5df6a4353b4e9dc6117e4cdad9e36dbafda534a5f80938f72292f407eaf785c69c1fc0e20ca083567b779cba1946d9960e286ca646154b4b5c5662d77d6225125b4bd2b51dcb3fd8478949c1097d615629c5dd48cb45147bdd6dab0f146b80fa9ec6f2e670652f6f203895feb3084ec122a1e812ac4fa637e355540e6bac"}, &(0x7f00000004c0)=0xd7) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000000)=0x200000000) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000680)={0x4, [0x0, 0x0, 0x0, 0x0]}, &(0x7f00000006c0)=0x14) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000700)={0x2, 0x3, 0x200, 0x10001, 0x8000, 0x7, 0x5, 0x0, r3}, 0x20) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000001c0)={{{@in6=@ipv4={[], [], @remote}, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={[], [], @loopback}}}, &(0x7f0000000740)=0xca) getresgid(&(0x7f0000000100)=0x0, &(0x7f0000000140), &(0x7f00000002c0)) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000780)={0x6, {{0x2, 0x4e21, @multicast1}}}, 0x88) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000640)) write$FUSE_ENTRY(r0, &(0x7f0000000300)={0x90, 0x0, 0x8, {0x6, 0x3, 0x1, 0xfff, 0x7fffffff, 0x5, {0x3, 0x0, 0x2805, 0x4, 0x5e280, 0x6, 0x3, 0x80000000, 0xfffffffffffffaaf, 0xe2a, 0x1ff, r4, r5, 0xfffffffeffffffff, 0x6}}}, 0x90) [ 487.725027] binder: send failed reply for transaction 1377, target dead [ 487.758764] binder: 22717 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 487.758777] binder: 22717:22720 ioctl c018620c 200001c0 returned -22 12:01:39 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:39 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x1100]}}, 0x1c) [ 487.789346] binder: 22718:22721 transaction failed 29201/-71, size 0-0 line 2741 12:01:39 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x408000, 0x0) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000600)={0x7, &(0x7f00000005c0)=[{}, {}, {}, {}, {}, {}, {}]}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, r0, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r1, 0x40000000af01, &(0x7f0000c97ff8)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000500)=0x0) migrate_pages(r2, 0x6, &(0x7f0000000540)=0x8000, &(0x7f0000000580)=0x3) write$FUSE_GETXATTR(r0, &(0x7f0000000080)={0x18, 0xfffffffffffffffe, 0x2, {0x8}}, 0x18) getsockopt$ARPT_SO_GET_ENTRIES(r0, 0x0, 0x61, &(0x7f00000003c0)={'filter\x00', 0xb3, "72070d8ab3aec0c3b051bb69b9b74fd4a5d9764737c4ae37f6566f981b170b281c930e38e234b9ca545e7c684d257f596fde2023ab5df6a4353b4e9dc6117e4cdad9e36dbafda534a5f80938f72292f407eaf785c69c1fc0e20ca083567b779cba1946d9960e286ca646154b4b5c5662d77d6225125b4bd2b51dcb3fd8478949c1097d615629c5dd48cb45147bdd6dab0f146b80fa9ec6f2e670652f6f203895feb3084ec122a1e812ac4fa637e355540e6bac"}, &(0x7f00000004c0)=0xd7) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000000)=0x200000000) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000680)={0x4, [0x0, 0x0, 0x0, 0x0]}, &(0x7f00000006c0)=0x14) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000700)={0x2, 0x3, 0x200, 0x10001, 0x8000, 0x7, 0x5, 0x0, r3}, 0x20) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000001c0)={{{@in6=@ipv4={[], [], @remote}, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={[], [], @loopback}}}, &(0x7f0000000740)=0xca) getresgid(&(0x7f0000000100)=0x0, &(0x7f0000000140), &(0x7f00000002c0)) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000780)={0x6, {{0x2, 0x4e21, @multicast1}}}, 0x88) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000640)) write$FUSE_ENTRY(r0, &(0x7f0000000300)={0x90, 0x0, 0x8, {0x6, 0x3, 0x1, 0xfff, 0x7fffffff, 0x5, {0x3, 0x0, 0x2805, 0x4, 0x5e280, 0x6, 0x3, 0x80000000, 0xfffffffffffffaaf, 0xe2a, 0x1ff, r4, r5, 0xfffffffeffffffff, 0x6}}}, 0x90) [ 487.840927] binder_alloc: binder_alloc_mmap_handler: 22718 20001000-20004000 already mapped failed -16 12:01:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 487.899433] binder: BINDER_SET_CONTEXT_MGR already set [ 487.918300] binder: 22718:22721 ioctl 40046207 0 returned -16 [ 487.955668] binder: 22718:22725 transaction failed 29201/-71, size 0-0 line 2741 [ 487.979015] binder_alloc: 22718: binder_alloc_buf, no vma 12:01:40 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x80fe]}}, 0x1c) [ 488.007747] XFS (loop3): Invalid superblock magic number [ 488.015343] binder: release 22718:22721 transaction 1381 out, still active [ 488.016414] binder: BINDER_SET_CONTEXT_MGR already set [ 488.023189] binder: 22718:22721 transaction failed 29189/-3, size 0-0 line 2973 [ 488.039485] binder: 22746:22751 ioctl 40046207 200001c0 returned -16 [ 488.049553] binder: undelivered TRANSACTION_COMPLETE 12:01:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 488.104631] binder_release_work: 39 callbacks suppressed [ 488.104638] binder: undelivered TRANSACTION_ERROR: 29189 [ 488.175149] binder: undelivered TRANSACTION_ERROR: 29201 [ 488.183067] binder: send failed reply for transaction 1381, target dead 12:01:40 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000040)={0x7f, 0x0, 0x2, 0x9}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f00000000c0)={0xd4, r2}) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) write$P9_ROPEN(r0, &(0x7f0000000100)={0x18, 0x71, 0x2, {{0x2, 0x2, 0x4}, 0x8}}, 0x18) 12:01:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce810e9"}) 12:01:40 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="786673ff", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:40 executing program 4: socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname(r0, &(0x7f00000002c0)=@pptp={0x18, 0x2, {0x0, @multicast1}}, &(0x7f00000001c0)=0x80) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x6, 0x100000000000031, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') r2 = syz_open_procfs(0x0, &(0x7f0000000200)="6c6f67696e7569640039dad3c444de4a35f0fd223db6aa1e2fdd63c9f35f389e4669e0af6522c225bbb645ae9e0f46c87cd44db4919c1a34ab1d00bb4157f79b23912e9b96566ebf23618dfdd331fcacfeccdb938974f48d420c49e5b37f94bdb651b9c102659034f4192f") sendfile(r1, r2, &(0x7f00000000c0), 0x1) io_submit(0x0, 0x0, &(0x7f00000006c0)) ioctl$DRM_IOCTL_MARK_BUFS(0xffffffffffffffff, 0x40206417, &(0x7f0000000180)) pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000280)) write(r4, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000100)) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) syz_open_dev$sg(&(0x7f0000000640)='/dev/sg#\x00', 0x0, 0x0) setpriority(0x0, 0x0, 0x3) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000340)={0x0, 0x80000001, 0x30}, &(0x7f0000000380)=0xc) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(0x0, 0x0) 12:01:40 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x14280000000000]}}, 0x1c) 12:01:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 488.249129] binder: 22770:22771 transaction failed 29201/-71, size 0-0 line 2741 [ 488.257879] binder_alloc: binder_alloc_mmap_handler: 22770 20001000-20004000 already mapped failed -16 [ 488.293048] binder: BINDER_SET_CONTEXT_MGR already set [ 488.339127] binder: 22770:22786 transaction failed 29201/-71, size 0-0 line 2741 12:01:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306202, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 488.389494] binder: 22770:22771 ioctl 40046207 0 returned -16 [ 488.407351] binder_alloc: 22770: binder_alloc_buf, no vma 12:01:40 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x9000000]}}, 0x1c) [ 488.464757] binder: undelivered TRANSACTION_ERROR: 29201 [ 488.470410] binder: send failed reply for transaction 1386 to 22770:22771 12:01:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce82ae9"}) [ 488.534825] binder: undelivered TRANSACTION_ERROR: 29201 [ 488.537821] binder: 22801:22803 ioctl c0306202 200001c0 returned -22 [ 488.540647] binder: undelivered TRANSACTION_ERROR: 29189 12:01:40 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f0000000040)='auxv\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000000)={0x0, 0xf5, 0x7, 0x10001}, &(0x7f00000000c0)=0x10) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r2, 0x84, 0x78, &(0x7f0000000100)=r4, 0x4) 12:01:40 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 488.576057] binder: undelivered TRANSACTION_COMPLETE [ 488.581191] binder: undelivered TRANSACTION_ERROR: 29189 [ 488.596369] net_ratelimit: 4 callbacks suppressed [ 488.596379] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:40 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x8010017d]}}, 0x1c) [ 488.687206] binder_alloc: binder_alloc_mmap_handler: 22809 20001000-20004000 already mapped failed -16 [ 488.733279] binder: BINDER_SET_CONTEXT_MGR already set 12:01:40 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r0 = getpgrp(0xffffffffffffffff) r1 = syz_open_procfs(r0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x6) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 488.776152] binder: 22809:22814 ioctl 40046207 0 returned -16 [ 488.776251] binder_alloc: 22809: binder_alloc_buf, no vma [ 488.787875] binder: release 22809:22814 transaction 1391 out, still active [ 488.811721] binder: undelivered TRANSACTION_COMPLETE 12:01:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x10, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 488.874660] binder: undelivered TRANSACTION_ERROR: 29201 [ 488.883252] XFS (loop3): Invalid superblock magic number [ 488.895455] binder: send failed reply for transaction 1391, target dead [ 488.938412] binder: undelivered TRANSACTION_ERROR: 29189 [ 488.984644] binder: 22843:22846 ioctl 10 200001c0 returned -22 [ 488.994962] binder: undelivered TRANSACTION_ERROR: 29201 [ 489.029369] binder: 22843:22846 ioctl 10 200001c0 returned -22 12:01:41 executing program 4: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz0\x00', 0x200002, 0x0) 12:01:41 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x2000000]}}, 0x1c) 12:01:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce814e9"}) 12:01:41 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$UI_SET_PROPBIT(r0, 0x4004556e, 0x4) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) timerfd_settime(r0, 0x1, &(0x7f00000000c0)={{r2, r3+10000000}, {0x0, 0x1c9c380}}, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) ioctl$KVM_GET_LAPIC(r0, 0x8400ae8e, &(0x7f0000000240)={"95858ab241c8673aa288ab0ab7b5c7196335a31b5536a5c42a14302305913517ac49e547410f266dd79be0ee01e50bc93162d947c84b8f983e83d8e5eebe974beccc776bd4de5badbab7a52e2c0fde8ef71940783f2c8868649275ff96f62621802bec7ce4afc0b677db55d28ad7644c5fde947754d3a51458550d7a4729cbf9fbc07aabf6d44c279bb2cc2f0bfeaa67bbcb19e89a6dc6746bf92e014efa3c77f25a7a98c592b3b75f0617bded283ebd46c3ba42959b6993f17300c8b21adca6ebb001aea1e0384772fcaed43f0613bc54bf07088546d681b4a31b14e7912db08a6587b114be6699a4d945d47e7928715fd630ee481549e3ef971d8c0628db145e181c9bd7b8bb7fbf4126a66bae5d9a0876d8f005cfc3abb9aa86002aa409d3b8142a92fc2dbc7bd2e0bc19bbc79ca138d43a9e9ce530df7423307fc435962bd70bfc347db1a2df6aabc14045a477131932a4455fe159eb5b203eeacd828ac68dc6952d59ce9c3598e7a3e24bfa872512265ec003069a902fe5ceb537f8c5594b9210f6fba3ecc93521fc2b7e63901e6ee6fdc5a9dde1603daee4f783ffa2115097e834e36c64e1b60492de99175ea03c934f9e0125ea805d359b9d8d4ceaeebad7d5da7b8052ddaa34e68a9ac1fea59fed42b482ef02b2431fcb1ed25d0da014211fb1a3a703d0a8c117e920052361f183038e4fd005a57fce28d27a21678d9d2bc62c9dd6e7ec2caf79c6abe55b1c49f8dbecfbc419fca2db80e27e65faed92aa1813f3d720022ab8caee928c23b341269bfd040b30326439cbb015bc6d422e6831b21108113e607e30b8acfe5855b9ce5b347fff1974d2d71dc13b44ef0d99a4e4e50dc71cfc73062bf59f949ceefb31e1ea64ff92c64ac90aa9738011346ff86ea0d02a73712c0fd3cf9b43c2f7bc24dad8428b3c2a4c0d06ebe915af7ceae552d1a4058b9c17e2dd1106628d992b901028616cd5c9742b0329d5c039dfcc2810344ec1dc625cb2082574f19949cc4e4e2aad2095aa33b8af2eb465bbf96619993988cf169e64104fd71d7cc5c96b2d0ab91f6a1b6ec9d6c366e45d7c15bc6b1cc921038765ac968b16fbb8dfad50586d5bc7066ad85f2c782ce0888b46cc4ba77ccc340c8cf950afc0e892224fac99b29e59ca59d5a645cdb280bf3cad19c9d8afbb6ba4d50ba90d4a2a3e2dcc185e5679c75bec01d67e0a36e08713b66ed66a33ec3b7ed8b5f97e886f99def8837194e9b5d072d5a7f907569aa967540326c3de18207a65a706e2c6700f224908aa970a86000ae8955c8e9805316f9a03b858578ae56aa6d50e4e4c8f6129c9ae8e2bb2b2fdf0e6bc56ccaa9491281b5fc1bd6af6fda26db0170e4f235ce64b052be9133ae8520b472a673f1e3a4be4dcdc454acd9aeacacc30e32e92448329e063df4316692f534c4807d2d6bf8e15"}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) 12:01:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:41 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:41 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/mcfilter\x00') preadv(r0, &(0x7f0000000480), 0x10000000000000f7, 0x10400003) [ 489.376256] binder_transaction: 26 callbacks suppressed [ 489.376266] binder: 22866:22871 got reply transaction with no transaction stack [ 489.396905] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:41 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x4) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:01:41 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x600]}}, 0x1c) [ 489.472763] binder_alloc: binder_alloc_mmap_handler: 22866 20001000-20004000 already mapped failed -16 [ 489.518076] binder: BINDER_SET_CONTEXT_MGR already set [ 489.523884] binder: 22866:22894 got reply transaction with no transaction stack [ 489.555197] XFS (loop3): Invalid superblock magic number 12:01:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 489.565304] binder: 22866:22871 ioctl 40046207 0 returned -16 [ 489.565605] binder: release 22866:22871 transaction 1396 out, still active [ 489.578981] binder_alloc: 22866: binder_alloc_buf, no vma [ 489.609268] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 489.613267] binder: undelivered TRANSACTION_COMPLETE 12:01:41 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0xffffffffffffff7a, &(0x7f0000002e00), 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x822, &(0x7f0000000040)=0x0) io_submit(r2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000013c0)=[{&(0x7f00000000c0)=""/68, 0x44}, {&(0x7f0000000140)=""/60, 0x3c}, {&(0x7f0000000240)=""/175, 0xaf}, {&(0x7f0000000180)}, {&(0x7f00000001c0)=""/55, 0x37}, {&(0x7f0000000300)=""/54, 0x36}, {&(0x7f0000000340)=""/4096, 0x111e}, {&(0x7f0000001340)=""/113, 0x71}], 0x8, 0x400000000000) 12:01:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:41 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x600000000000000]}}, 0x1c) [ 489.704789] binder: undelivered TRANSACTION_ERROR: 29201 [ 489.734725] binder: send failed reply for transaction 1396, target dead 12:01:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce83be9"}) 12:01:41 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:41 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="b7f2288a911993f0265df5cf1cdd06d6", 0x10) r1 = accept$alg(r0, 0x0, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[], 0xffffffaa) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400218) recvmmsg(r1, &(0x7f0000005a00)=[{{&(0x7f0000001bc0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000001e00)=[{&(0x7f0000001c40)=""/180, 0x20035c40}], 0x1, &(0x7f0000001e40)=""/213, 0xd5}}], 0x400002d, 0x0, &(0x7f0000005c00)={0x77359400}) [ 489.844063] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:41 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xff0f000000000000]}}, 0x1c) 12:01:41 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x1, 0x101000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:01:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 489.930875] binder: 22932:22933 got reply transaction with no transaction stack [ 489.998494] binder: BINDER_SET_CONTEXT_MGR already set [ 490.033920] binder: 22932:22955 got reply transaction with no transaction stack [ 490.034001] binder_alloc: 22932: binder_alloc_buf, no vma [ 490.042217] XFS (loop3): Invalid superblock magic number [ 490.057811] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 490.078884] binder: release 22932:22933 transaction 1401 out, still active [ 490.089298] binder: undelivered TRANSACTION_COMPLETE [ 490.098789] binder: 22932:22933 ioctl 40046207 0 returned -16 12:01:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:42 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) lsetxattr$security_smack_entry(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='security.SMACK64IPIN\x00', &(0x7f0000000340)='net/arp\x00', 0x8, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000240)=ANY=[@ANYRES32=0x0, @ANYBLOB="33000000348349a1054735297a0e346459b9a6717cc35bfc4dc0fe77848a1eb621c9e1b93f58dfcb6ee097a26da80afc2f72e8d350e0090726bcba2f4a77404b3e1b24663a52f9ba87a745297c253fa68371a856c68f990491307163f6c48f10b9330a553ade521aab79e15b2568581e6b7773534edf338e1d5e88acbce136b1aa69af08"], &(0x7f00000000c0)=0x3b) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000100)={r1, @in={{0x2, 0x4e24}}, 0x5ffa, 0x8, 0x8, 0x1, 0x100000000}, &(0x7f00000001c0)=0x98) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:01:42 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x1000000]}}, 0x1c) 12:01:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce804e9"}) [ 490.130101] binder: send failed reply for transaction 1401, target dead 12:01:42 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="786673c0", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:42 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x44080, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 490.296535] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 490.309865] binder: 22979:22980 got reply transaction with no transaction stack 12:01:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 490.366936] binder: BINDER_SET_CONTEXT_MGR already set 12:01:42 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xdc7f0000]}}, 0x1c) [ 490.393718] binder: 22979:22992 got reply transaction with no transaction stack [ 490.426284] binder_alloc: 22979: binder_alloc_buf, no vma [ 490.442513] binder: release 22979:22980 transaction 1406 out, still active [ 490.450430] binder: 22979:22980 ioctl 40046207 0 returned -16 [ 490.504735] binder: send failed reply for transaction 1406, target dead [ 490.516025] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:42 executing program 4: r0 = socket(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000003700)=[{{&(0x7f0000001dc0)=@alg, 0x80, &(0x7f00000006c0), 0x0, &(0x7f0000003600)=""/200, 0xc8}}], 0x1, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000300), 0xc, &(0x7f0000000040)={&(0x7f0000000100)={0x14, 0x1e, 0x201}, 0x14}}, 0x0) 12:01:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:42 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') r1 = fcntl$dupfd(r0, 0x406, r0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000000c0)=@broute={'broute\x00', 0x20, 0x3, 0x548, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000240], 0x0, &(0x7f0000000040), &(0x7f0000000240)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, [{{{0x9, 0x13, 0xf9, '\x00', 'eql\x00', 'team0\x00', 'veth1_to_bond\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, [0xff, 0xff, 0xff, 0x0, 0xff, 0xff], @local, [0xff, 0x0, 0x0, 0x0, 0xff, 0xff], 0x148, 0x1a8, 0x1d8, [@mark_m={'mark_m\x00', 0x18, {{0x6, 0x2, 0x2, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'veth1_to_bridge\x00', {0xff}, 'bcsf0\x00', {0xff}, 0x2, 0x10}}}]}, [@common=@AUDIT={'AUDIT\x00', 0x8, {{0x2}}}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x6}}}]}, @common=@redirect={'redirect\x00', 0x8, {{0xfffffffffffffffe}}}}, {{{0x11, 0x20, 0x4, 'veth0_to_team\x00', 'gre0\x00', 'sit0\x00', 'veth1_to_team\x00', @dev={[], 0x17}, [0xff, 0x0, 0xff, 0x0, 0xff], @broadcast, [0x0, 0xff, 0xff, 0xff], 0xd8, 0x110, 0x140, [@realm={'realm\x00', 0x10, {{0x10000, 0x9}}}, @state={'state\x00', 0x8, {{0x401}}}]}, [@common=@dnat={'dnat\x00', 0x10, {{@dev={[], 0xd}, 0xfffffffffffffffd}}}]}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x2}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0xd, 0x40, 0x22eb, 'rose0\x00', 'veth1_to_bond\x00', 'nr0\x00', 'gretap0\x00', @local, [0xff, 0xff, 0xff, 0x0, 0xff, 0xff], @remote, [0x0, 0xff, 0xff, 0x0, 0xff, 0xff], 0x110, 0x170, 0x1a0, [@time={'time\x00', 0x18, {{0x5, 0x459ff746, 0x150f0, 0x81fd, 0x4, 0x3, 0x3}}}, @arp={'arp\x00', 0x38, {{0x337, 0x88e5, 0x1, @multicast1, 0xffffff00, @rand_addr=0x1ff, 0xffffff00, @dev={[], 0xa}, [0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @broadcast, [0x0, 0xff, 0xff, 0xff, 0xff], 0x4, 0x8}}}]}, [@common=@AUDIT={'AUDIT\x00', 0x8, {{0x2}}}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8}]}, @common=@AUDIT={'AUDIT\x00', 0x8, {{0x3}}}}]}]}, 0x5c0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r2, &(0x7f00000017c0), 0x0, 0x400000000000) 12:01:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce850e9"}) 12:01:42 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:42 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x2000000000000]}}, 0x1c) [ 490.720522] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 490.732717] binder: 23012:23013 got reply transaction with no transaction stack 12:01:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:42 executing program 5: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhci\x00', 0x40, 0x0) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000280)={0x7ff, {0x2, 0x4e21, @multicast1}, {0x2, 0x4e21, @local}, {0x2, 0x4e23, @multicast2}, 0x89, 0x5, 0x9ef9c95, 0x7ff, 0x6, 0x0, 0xde0000000000000, 0x7, 0x1}) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhci\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000040)={0x6, 0x9, 0x8, 0x5}, 0x8) recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x2c}], 0x27, &(0x7f0000000100)=""/16, 0x10}}], 0x0, 0x40, &(0x7f0000000080)={0x77359400}) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000140)) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000000)={0x7f, 0x0, 0x10001, 0x3}) ioctl$DRM_IOCTL_AGP_BIND(r1, 0x40106436, &(0x7f00000001c0)={r2, 0x4}) fallocate(r1, 0x5a, 0xff, 0x5) syz_open_procfs(0x0, &(0x7f00000000c0)="a0") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_DEASSIGN_PCI_DEVICE(r0, 0x4040ae72, &(0x7f0000000300)={0x3, 0x2, 0x81, 0x0, 0x8001}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 490.766436] binder_alloc_mmap_handler: 2 callbacks suppressed [ 490.766454] binder_alloc: binder_alloc_mmap_handler: 23012 20001000-20004000 already mapped failed -16 12:01:42 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xfe80000000000000]}}, 0x1c) [ 490.812256] binder: BINDER_SET_CONTEXT_MGR already set 12:01:42 executing program 4: r0 = open$dir(&(0x7f0000001240)='./file0\x00', 0x400000002c2, 0x0) writev(0xffffffffffffffff, &(0x7f0000000380), 0x0) writev(r0, &(0x7f0000000200)=[{&(0x7f0000005280)="bd009fc85123ff8820307bd4403a477296a8a95c1725ccebf230bf41209516d41c6fd6ea55696f2418396d582d05e714df097a4a39517a2ae597128f68ab38a78859a15276437b9bd0874387e6782a6982b6399c2013e3a7b02cd2c36a26fca6791f9bf212ee9aed5e2728518ff03d70a3fff68d0b3a5b26ddb3e09c9b726bc239e8c00c2ee2052eb841486980e6dcde0156ecad4591624740782294d69c16b842a87c9f977c4e0c7ffeb517daedeee7d04f8dbb67ee09c94a9bd0aead3f8e63c3663cf72034cfb10ecccf0e351eea287d0f42ca4e2baecc5c589e7da0b04b94e063e49d6fad07e5fa7f162e8eb0b4a8f6200b836619cad0e02adc574db89a5e5af3c5723930131db8b336c179342aff1a0020cb25f17e5faa522a4aecf6daede7ccc09850deb5f5bbd82f12b49e03f5af39722765ca914eed155e873ecae0584f683d30009922c579f0387e6bdd80d5c4c544fed85e8abbe528edefd554b7870da247ee50a5f55cea158d3ad979c67d3cbbf3ff18f8bb9a05584bccc46840837d55fe33cddbe72eca60951bda6192f3abced47dddf6bb4fb6a21ad2ec814b09ba8af8c8ec927ce02c2367ea061e8a695bb43aa89393c322fabc3dbb8b5ee5d358f500584404e86b860972733f0490118b6508ecfad81ee80385bad149713d199c018d016fc60fc1198d80b6fb374d808609a1f6f316bdefdee1a21f27951dd35be4800df064d760979a978a5b0058fe1a3d5f7c59cae85a150897d8367bacfb7b2b911254297da1ea412173f23fb3bc662fccf168cad0636fcce1fda9ad2845a11dd29f60d7335ae0fac831f385ccfb3998e13dbc927a52e97746160dc60a3dd6648e9621d7e6abeb60fd2d291cc74d2fb7fe5e141d90e78daa56aecfef4de2ed13a64968871cd4d473b178d2ac7d1f8cf8a038844805ccc5dcf0fec712091b4d4d214bc159928cd6fa29004a17eacdbff42718dbcf3a2c0cffe7d21002c50388f7a64c962e812149220eccabc8cf89d34e820c92a02ac51e67a60de5abc7c9fa4b7236cfff06d62a4cef3bb7264f3e6f88aed392d20e4f393c22565311f08f2802a9397341223cee93f97c0d167dee23e8a0e8fbfa2d21fc684944c9e9631c6557357fb1287bf726e416cdf721a32a0abdf6df3e02f5dafa88bfc1233ed493204bcc3b9e6fafcae385fa70ae5e561e66aca138b82aa71384bc5216ea8de426effe0a1a6ecfaf32062039c04b38c5253df630b388a03691fd16aae924040aae1af0504f3cc9124bc0bcbd0b4cd3e5fc1c603a0b13fad60ae933faef43b204cc88ca28a1d1a70d7ebdfe5b5bdb47e8cee1924bf9a94b1477b4c4e9fe55029ef87007e378bed12b25429a39c14bd68002be7cf6be4451c8877a94efd235ec4b4cdfd2814fe77acef526b482806f789e7298cfc94f2d8b4fbc78451edbbd03300ac968519a650fb33b73a1272875dd7a4c4363aa3ccc36641df92c4f84daf3ead5e32441e4ece465b42b6fdc88495afaef816d442f58cf117f7ce1b5603e343a402b98bf65a64dc40f677b3fbaf970be5a9cc242c0525b5f8dac85a52206cb32b103e6ba929c8f8b3fae1b46ad16428cfe634e7b63e55629c43b9df86f3bf8334050cf0984dc054221d21e8a9c29d7c171dee6e1b8190c2d8117a2ba67b97519861aeeff9ae24654b605b265ee750fae3d656a07e4334cfaf6f604146821e685be326f286dd190f600d7b2f1121b1c4fceb06f65f7954fb9b9cf994809b098b96d1565c55f4661259dfa2b0dc17eb30cd7447f0a0697ed4693d216b34a937894ebbfba1a8aa8bf1725b7a24669f2a8d1f0fff1812c69a03bc03a5b73372b3be00343eaaf416b4e58ad4008f9fb4caa7cbd246530d48517aa841bd17dc1331024f43af4a4132f5ea53bcb6c1d6d868e73aac9da6b5238b49dfe4c8ad292cce900e75c45fbb50274984d21a502b23883b95599a4cfb68dcab188a7f76010967a5ef15699ce2c8c604e50a9516aef90df223efe46af4787d2e03daa92e0aedbfd6ae1bcaa227f27c9d61007121368c50f937f33bc26b7c58a5ad87357c84f7b5a359e3c6f8575b4e27e00172fc45fa1e70bc3b56223b00d0821f416819b161726cb6abf00bea1c1a79b7a768da494dd9595d5cd4f70d9591d6c0fd0f51a5074828094a26d21dcaea56b04912d728f917b46757e0bb3c4d6bd36cce9a0a09b6b91a041f7e26940fe95c57e5a741cbf0eab3d9f7f3aa9f49234d5d2422fda2ee798f65b8fa6b5184e530cd0399e52ec3ad283bcc30344d19e7e1b1e81ea47db71b6993c121a75d161ebef11a073b347704635444a0782c8ec669292797129dda623599d7adb89bc9bf27edcf78380a96a9169e05f9ac826fc9de0cb325eb2a924cb1f4dd6bdac55954ce247b8ea4cd91f995807a4ff6b74db87578396ad351934f7c09766ee4ec34750c909f4ba05de92075999ecb8d36acbdda7ba9d0f9e0057d4275c92bee7ffb64f29f412a11ec4edd897a951a0b8d8aeee29b31d31f45d0af61cb0c3ccea5320aed371c135e3905f23c0e5ffa9515428a89b6209a6969475173979e5a6788554ccbd0d7edbb2bcb8bb6051b05cdafe8fb84e9517a27ecd58c71953044599f055b8d1cffd50f159e1f3703bdb9aac4c0595e7dee6ece8e565cfbe4276de8eec90b6a3d2c0c7533a8342a6992d9447de719dab2a6c13abdf83504a792ef948ee164414d29a726c768722e07d02abaf0ed345779aad7445b4b98f86a3d403aef885a2d9ab374fcc38389775e9274210e509324a2ed28a7d18c31f80b54d9fb46ee973d4782899606e9cee4d593b35a5db8df8d8710055cb9b58f0f9af32bbe55fcb1a2e500b08ff2fdf7a1226a341066ed2968dd486f34ff9c258b954547420e0a185ff31c63099b96c9d76506cea84afdd7b8747c989855fea95c1fc54841e0537a7a8b292ce06377b81daeedc0857858d76c1d48f1af1c9e283251f516ffd9ba62a32c422bb375c62ed9de6a3751ff30dc1c8a2c418a066db628812a8fc765bf17199790c597b7a61ac443c4d2aa364a9c6828d726162bfcc24839d7c97d44674371b059e88d2b98ac0f0cab3d8eedb22eb17570274a1540e7d7e7023b7c3fd61e015b038ff6180863c4b4aa718d44d76a1c05a967e2a3deed1d488039c1371d1f943eaa285d2ed5ff863cbbcd067a1d47b054ee952760691f68bc735c4f140ce0bd4d0f580fe352dc2d15849fbe2e1fdabe560afbdb223faffc7e9e34f979cbbb4de45bed3cc6e931a605e53c0e9fc67f80896dffb49ceb02d35dc3fbbadcbffa7847c01ce681766432eaeb528efeae3de6146c231ce5e0ba2dd6dadc4070dd5b66bd375aededfa27a2d77c00a47ab8ad0dd4ff5161941537f9e61b38dc83fa2e13389d8a8a900899c4787bcfa519f038dd3a31fa2edf1919b262ae2c5aff73167d40069251e1a7a2d7534f9569563fec3cc32a81d552a80a414f4104dc84393f3bb14a7f3cd83487fb85a0bd004c99248bffc9d21e5c74f447fc229360565031a738021e9b9ae7f946b021c4b7b850e7d23b0fe4d64553eaa7192c505bf7ee6e94e9fc156c8fd2971738e72e4d2c58645a581453b34b8c5b366a65bf8f36883d7571cb07bf6ebba6fe8ef2bf335a0ce05e3b0d03cec8f8e14cfaefd082ed2703c71302f3f69e6bdfe867111e4973ac4d81984d1cc6ac10860f2606a9a88ba04112e6d4fc160add81ec980afb433daa4628bf1c7c4a8a0385cce81ebe1eae8318901a3808fd086dfc9d00a4b373da6bb2928fc135d0793954b999c0cda008846ac40667126da68726c8a02323a4b3c6ef23b641a5aef019ea04dc7a4f7f23c8e3088efeedf7ab8181e8ab7692f40d6055b96802d4859a9e5d0916057812bf63a2cc1cc55199b46749480cdeccc9aaf2b85a7e6e284a886d20332e799f091f0bc2a83c238d106ef162e74256ab3e0e16afd40501463abd77ba7e2964636e134a69bf6de81a7bcbbf510fd0dbe304569094332ed9adab9e4bc8ef7ec8c3f65069a12f08536a3294c88f1e08b7f65a9024e768b5a82a646fadc49c5bb350325654698a90f05cf029783d9b83c5c4c7b8566e972de2b02e55aada007acd04650ee8e82a849c593333cbb99ba2141d4de51e13920e09fc95e80b314a60fc5f9033d4d3fa62aca7c746ed7c3f94ec4fbc5e367a8f302973f84e50b50da37c6394721f3d9c6b012f93a917bcb170dd1eba37c0c6c807e050720cd38b67f3e45326fe2b738e56e28d648e3462c584d5ba8202f830ecfe16e430a2de19abe63939cc3cc160086100c009e23b348382b3e2e548fb3895c2be08efc87942b23857232f773d52512e844e2e7f3563302ed664aff747c66989400666e0cff75d32643c49548847dc453d7548939792890143707c47483bdc3eed29bf967f6fa83a5913ee490eb9d164cb14ba36f6c4fd738a008c8ababec1aee4a3a87c74ae97f14354fb4ff5dbd06225921eda0ca958f32a005e71ff371337985b123c1508a47b72970a74e8e52694f2008b01b7f3a85b7f45c33c71567c477f7353e7dceca2464e84cb5caf5951642c4f7ed5d04d4d089ecf914ec847ecb8d75bb9a73ee494d03efbbd4d4060d10000ed58dff9608c1ca7682d82a0ce035f9cb306add2edfc864285b3167dbc474400749ab7d9a6b9cf09edfd832be5164a16bfc013dc3000fdc23306be2c03c784a0a5a4715a51ee28cb4b209fccf6ba640309d8cccc4e894596f924139a03e32eead9cace2a08042c0f2de73c1ce2c64a6d780da5b3cab0f2a04c8f8809e0680fcc0d88b0f966b1fee58711f4e8d2ced2ab05c231e174ee61d6e813c6f47a2cb9b9506f67dd848f73e447ab9be428faaa0fd1206aa2ec2811c72060c8132e3f76a1daffeacb23016c61dd373f6c419adecf666038d6544f6bbbb19c27a5fbe76c947faccc257870781b064d21cb468734144aa529afd0b81a1cf3de8a26e2cc89121a8f7550ca86b8fd7cd0db50d26eeafca6c5641143d1886c479bf2669b20a0075409f41a1282d8d60ee3e9810cec70b808b2fb7cd74a3632ae600cc0c8501769ba68e7c08da0ee0c8c6ac774e41ba7e522b277fcb245d27be2495c035b5d9cf167881d2f91d36ef0190c1c4486f20a131b8c98e7c5fe4d65cb6aa8ac2553c70a776a38ea475d74d585858ab0afa31608abc601f3ab9f0912150e5f474a014310d97507a52193c4d686df5b9d5df36cb020412f5f2ab6f3b02dac33d3b07e282f5864c80d2bfd6b823367a8f3ff5d2c9061617f5a736d6a70501645f93da655e3899d56fdd3c7c96c484c56e667aadc104cfc217acd79b3cd065632fd9ba8acd63324a1d308d3e22a7b75ddb14a2a64e43456947e0535f95ff7f1c9b0877760eb87b88d57b9af40ce3f840d58d2d2a0235b4bd6d0bc68c15da16b9342e26118c026de9", 0xf0b}], 0x1) open$dir(&(0x7f0000000000)='./file0\x00', 0x10c01, 0x0) [ 490.848899] binder: 23012:23013 ioctl 40046207 0 returned -16 [ 490.857377] XFS (loop3): Invalid superblock magic number 12:01:42 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x800, 0x7a1}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000100)={r2, @in={{0x2, 0x4e23, @multicast2}}}, 0x84) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:01:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306225, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 490.929916] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 490.932444] binder: 23012:23030 got reply transaction with no transaction stack 12:01:42 executing program 4: socket$inet6(0xa, 0x1000000000002, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cuse\x00', 0x2, 0x0) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000080)={0x0, 0x4004400}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000919000/0x400000)=nil, 0x400000, 0xffffffffffffffff, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) r3 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340), 0x0, 0x81806) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) sendfile(r2, r2, &(0x7f0000000000), 0x2000005) open(&(0x7f0000001580)='./file0\x00', 0x800, 0x24) ioctl$LOOP_CLR_FD(r2, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000380)={0x0, @in6={{0xa, 0x4e21, 0x4, @mcast1}}, 0xffffffff}, &(0x7f00000004c0)=0x90) llistxattr(&(0x7f0000000240)='./file0\x00', &(0x7f0000000080)=""/188, 0xffffffffffffffc4) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x3e6}], 0x0, 0x0) 12:01:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce816e9"}) [ 491.015470] binder: send failed reply for transaction 1411 to 23012:23013 12:01:43 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xff000000]}}, 0x1c) 12:01:43 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="786673f5", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 491.097712] binder: 23065:23067 ioctl c0306225 200001c0 returned -22 [ 491.132697] binder: 23069:23071 got reply transaction with no transaction stack 12:01:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x48, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:43 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, r0, 0x3}, 0xc) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 491.212926] binder_alloc: binder_alloc_mmap_handler: 23069 20001000-20004000 already mapped failed -16 [ 491.255757] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 491.278418] binder: 23084:23085 got reply transaction with no transaction stack [ 491.295718] binder: BINDER_SET_CONTEXT_MGR already set 12:01:43 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xfc00]}}, 0x1c) [ 491.323266] binder: 23069:23071 ioctl 40046207 0 returned -16 [ 491.332122] binder: 23084:23085 ioctl c0306201 200001c0 returned -14 [ 491.360354] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 491.360364] binder_alloc: 23069: binder_alloc_buf, no vma 12:01:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:43 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) socket$unix(0x1, 0x2, 0x0) 12:01:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce84de9"}) [ 491.494686] binder: send failed reply for transaction 1416 to 23069:23071 [ 491.527851] binder_release_work: 2 callbacks suppressed [ 491.527857] binder: undelivered TRANSACTION_COMPLETE 12:01:43 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 491.565579] binder: 23101:23102 ioctl c0306201 200001c0 returned -14 12:01:43 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x20000]}}, 0x1c) [ 491.672034] binder_alloc: binder_alloc_mmap_handler: 23109 20001000-20004000 already mapped failed -16 [ 491.716135] binder: BINDER_SET_CONTEXT_MGR already set [ 491.734101] binder: 23109:23113 ioctl 40046207 0 returned -16 [ 491.800554] binder_alloc: 23109: binder_alloc_buf, no vma [ 491.801519] binder: release 23109:23113 transaction 1423 out, still active [ 491.813599] binder: undelivered TRANSACTION_COMPLETE [ 491.862570] XFS (loop3): Invalid superblock magic number 12:01:43 executing program 4: 12:01:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x63, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:43 executing program 5: r0 = socket$inet_smc(0x2b, 0x1, 0x0) recvmmsg(r0, &(0x7f0000005f80)=[{{&(0x7f0000000500)=@hci, 0x80, &(0x7f0000002e00), 0x1, &(0x7f0000002e40)=""/16, 0xfffffffffffffe73}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f0000000480)={'lo\x00', {0x2, 0x4e22, @multicast1}}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(r2, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB="ff07d3cf", @ANYRES16=r4, @ANYBLOB="00022bbd7000ffdbdf250300000008000400060000003000020014000100ff02000000000000000000000000000108000b000a000000080008000400000008000b000a00000008000500030000002c00030008000300000000000800030002000000080007004e2000000800010002000000080007004e220000080005000900000030000300080004000800000014000600ff010000000000000000000000000001080004000400000008000400e11f0000"], 0xfffffffffffffff0}, 0x1, 0x0, 0x0, 0x800}, 0x80) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) setsockopt$RDS_GET_MR_FOR_DEST(r1, 0x114, 0x7, &(0x7f0000000240)={@alg={0x26, 'hash\x00', 0x0, 0x0, 'sha256-generic\x00'}, {&(0x7f00000000c0)=""/223, 0xdf}, &(0x7f0000000040), 0x20}, 0xa0) 12:01:43 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xf5ffffff]}}, 0x1c) 12:01:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce822e9"}) [ 491.926786] binder: send failed reply for transaction 1423, target dead [ 491.947937] XFS (loop3): Invalid superblock magic number 12:01:44 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000040), 0x1000000000000272, 0x400000000000) [ 492.013827] binder_transaction: 24 callbacks suppressed [ 492.013845] binder: 23155:23156 transaction failed 29201/-71, size 0-0 line 2741 [ 492.039801] binder: 23160:23161 transaction failed 29201/-71, size 0-0 line 2741 12:01:44 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:44 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x16000000]}}, 0x1c) 12:01:44 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) setsockopt$inet_sctp6_SCTP_INITMSG(r2, 0x84, 0x22, &(0x7f0000000000), 0x8) close(r2) close(r1) [ 492.070826] binder_alloc: binder_alloc_mmap_handler: 23160 20001000-20004000 already mapped failed -16 [ 492.080520] binder: 23155:23156 ioctl c0306201 200001c0 returned -14 [ 492.105475] binder: BINDER_SET_CONTEXT_MGR already set [ 492.110835] binder: 23160:23161 ioctl 40046207 0 returned -16 12:01:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:44 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$INOTIFY_IOC_SETNEXTWD(r0, 0x40044900, 0xffffffff) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0xfffffffffffffdb4) [ 492.175869] binder: 23160:23177 transaction failed 29201/-71, size 0-0 line 2741 [ 492.175892] binder_alloc: 23160: binder_alloc_buf, no vma 12:01:44 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x7000000]}}, 0x1c) [ 492.273540] binder: 23187:23188 transaction failed 29201/-71, size 0-0 line 2741 [ 492.306538] binder: send failed reply for transaction 1429 to 23160:23161 [ 492.308479] binder: 23187:23188 ioctl c0306201 200001c0 returned -14 12:01:44 executing program 5: r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x1ff, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x101000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x8000) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xad7f) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r3, &(0x7f0000a8d000)={&(0x7f0000c78ff4), 0xc, &(0x7f0000df6000)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c0000001000fdff0000002d15003f000004000000009e19c383176e295958a732f942cb6031378a265fbeeb37560168b9c5ff55fe9d253e33cff68c1488c75043256c538aa22efe8e7e33332ccb11dd398f43c3dcf9333b561d8fc95e6b3f9ec2e1593ad6687e59ec0006f5031b516c713f1d7be07b9f4355dbef789d95b595d15307a3c5441ccd977dedf6ad4bb634c99afe19b8ca8d062f76ed1a86de2c6ec2baf66192316d"], 0x1c}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='net/unix\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KDENABIO(r4, 0x4b36) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) preadv(r4, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 492.323277] binder: undelivered TRANSACTION_COMPLETE [ 492.330826] binder: 23160:23176 transaction failed 29189/-3, size 0-0 line 2973 [ 492.362977] XFS (loop3): Invalid superblock magic number 12:01:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4800, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce815e9"}) [ 492.409282] netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. 12:01:44 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000100)=0x5, 0x4) sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10) sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)={0x14}, 0x14}}, 0x0) recvfrom(r0, &(0x7f0000000380)=""/239, 0xef, 0x0, 0x0, 0xfffffffffffffff6) 12:01:44 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x218]}}, 0x1c) [ 492.487397] netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. [ 492.512723] binder: 23221:23222 transaction failed 29201/-71, size 0-0 line 2741 [ 492.526134] binder: 23223:23224 transaction failed 29201/-71, size 0-0 line 2741 12:01:44 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:44 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000003fe8)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000000)={0x0, 0x7f}, 0x8) close(r1) close(0xffffffffffffffff) 12:01:44 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f00000000c0)={0x2, &(0x7f0000000040)=[{0x6, 0x1ea, 0x3ff, 0x4}, {0x7, 0x1, 0x9, 0x7}]}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 492.587783] binder: 23221:23222 ioctl c0306201 200001c0 returned -14 [ 492.600636] binder_alloc: binder_alloc_mmap_handler: 23223 20001000-20004000 already mapped failed -16 12:01:44 executing program 4: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sysfs$1(0xffffff1f, &(0x7f0000000100)='{user)%em0\x00') [ 492.678626] binder: BINDER_SET_CONTEXT_MGR already set [ 492.703379] binder: 23223:23224 ioctl 40046207 0 returned -16 12:01:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x5, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 492.731012] binder_alloc: 23223: binder_alloc_buf, no vma [ 492.740140] binder: 23223:23249 transaction failed 29201/-71, size 0-0 line 2741 [ 492.748250] binder: 23223:23231 transaction failed 29189/-3, size 0-0 line 2973 [ 492.757600] binder: release 23223:23224 transaction 1436 out, still active [ 492.776282] binder: undelivered TRANSACTION_COMPLETE 12:01:44 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x7]}}, 0x1c) [ 492.778177] XFS (loop3): Invalid superblock magic number 12:01:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce825e9"}) 12:01:44 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x4000) [ 492.850987] binder: 23259:23262 transaction failed 29201/-71, size 0-0 line 2741 [ 492.895425] binder: send failed reply for transaction 1436, target dead [ 492.912353] binder: 23259:23262 ioctl c0306201 200001c0 returned -14 12:01:44 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r0, 0x4008af23, &(0x7f0000000000)={0x3, 0x81}) shmget(0x0, 0x1000, 0x7800086c, &(0x7f0000ffd000/0x1000)=nil) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:01:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x7, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 492.964785] binder_alloc: binder_alloc_mmap_handler: 23273 20001000-20004000 already mapped failed -16 12:01:45 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:45 executing program 4: [ 493.009074] binder: BINDER_SET_CONTEXT_MGR already set 12:01:45 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xa000000]}}, 0x1c) [ 493.040726] binder: 23273:23274 ioctl 40046207 0 returned -16 [ 493.055638] binder_alloc: 23273: binder_alloc_buf, no vma 12:01:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x2, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 493.118100] binder: release 23273:23274 transaction 1442 out, still active [ 493.130021] binder: undelivered TRANSACTION_COMPLETE 12:01:45 executing program 4: [ 493.178113] binder_release_work: 26 callbacks suppressed [ 493.178120] binder: undelivered TRANSACTION_ERROR: 29189 12:01:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce842e9"}) 12:01:45 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}, 0x200000000}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000040)={0x0, 0x2}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000100)={r2, @in6={{0xa, 0x4e21, 0x40, @ipv4={[], [], @remote}, 0x9}}, 0x0, 0x7, 0x0, 0x101, 0x20}, 0x98) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:01:45 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xfc000000]}}, 0x1c) [ 493.236544] binder: 23304:23305 unknown command 16456 [ 493.254723] binder: undelivered TRANSACTION_ERROR: 29201 [ 493.260612] binder: send failed reply for transaction 1442, target dead [ 493.299340] binder: 23304:23305 ioctl c0306201 200001c0 returned -22 [ 493.308603] XFS (loop3): Invalid superblock magic number [ 493.333030] binder: 23304:23305 unknown command 16456 12:01:45 executing program 4: [ 493.360919] binder_alloc: binder_alloc_mmap_handler: 23316 20001000-20004000 already mapped failed -16 [ 493.363475] binder: 23304:23305 ioctl c0306201 200001c0 returned -22 12:01:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x6000000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:45 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) ioctl$sock_netdev_private(r0, 0x89fe, &(0x7f0000000240)="0df156d7e7771382fc876aa95519559824ed8a62914667dcd9fa58e06a637bdd1a29fb065ada1d2ffc1cfe947ad652c5102d85eb1c168b257074b3af9f376bb8bbc153558e593ee00865c7f5ddd3ce984b7fc53c26027b324587c0ded5fbec760bcfab7baa5573c7ed48f307ee646019da4a564a69eedf334bcdf782b440413018661e0d5c52a750e1b3e67fd37cc047056e9265cb7e72322f0075b6cb63b75078ce3fe7c26de97e9b8b1c228f8677b0517ed7c1c258b349eb35a9828976d4a83e042ead0746c6848726eb15ab6c85d0c0a94b35a8d3fe36dae468e07e8aa2c1ba3ebbb84a58a4d764d6b3be4c86a20f854e79b2c0a6e636d500ef20e50fe6169de27597b523a09d153676252dace306b15116c32a711a41818a069edc81e466755d7ccd266d3f9b183017e7a9c9cfbb7bdd0a544131439b89e81d058a7ef2a432826ca367fc922b68c64fa3273ccd214d8c155af8549e5bad9fe2b5eb8a1f84cd151ac355dfcd093974fdadf95bd918e5ce8aa1dd3d87e0f93e2cbd1d3f969e3c11f226678b87bf99b1c6fa639cfb530d4c398503dd474e8f175749528cdb7e3a70433e6474ba46375a9b5a79564ca7b1965c364038d5152efd5a552f1f52a6c7451b051cd7caeaf69603d070e0b04186190a7983f2a7a3f346e9bc90070e8c361022cddf5e8937e577440a51d81ba280dc2966c0b0828ca8fe4db3a6ee9715af53286dec7a52b93537629ff1e831e15495bd0163cad4eec02905f180aa66e1a320ce8034662b9f80a59d09afa952e27708863f3f3077bb7fdfbb753160a7ec3becd25109407c1d2aeae2f5969fb21b54cae291a6ded495d19767e7fd669eda12a464fcd20bd69ae3184837ce412343725878ab0abdbca603925468117439f442e1d5e57cfa6c83fdf7d2a6946f05a7ccc2fc0e3df3b0f8344d606532ce54b61560a1c7de41bd50b3570d341c202527fdffac6a40dfa7ffcdf839705666cc57775c12078bb4ffc35d210448b98f392cf01d9085f3fb0a16b8ee18b811b211c9a8a42667cc2b438857dac5bd39504e14fbc975ee4c5191b8375a2e0f6d09299470bfc4ecd4aa2f1e18c420dd391e9ee9948614ebc59fc33eefdfbaec16c59170e68242c548294e5c14ac3fb05d067a268aef557653329c0583e8861c93516a0c2132c0d098e408dc91339e08fbd46f2d3ab59f93f7ef76511e1a0bc8047cb54ffdc96298b4477beacc47bd9594e16c502c29678f6dec4d5724e9b625b9b3a899a0ef269e194a58d4d71b79fe31e130b4d14d361616bf95f66b1bfd5c24871337293865640bcf1e19be83f088a2ffefa2432abb9a1b7c9d6aef960cf9bf3ba5f33c18c302490de8e174cba532cc307fb22602feef441395f9018adf22884f2e753de344f7107bbba3c77ee87c540d051e15e12929451479d2a0af23184a14cf88843e07d9620698c813d3b5a866b9b1da2bcdf50524aabf5d1b721950fd8bc4652fb08c31c2908abad4f3b02bccc7071789f1fcc5b7efcd41a2fe68cfb76b92b037adbc35d4dd69817dc8f2d7f4aff4eae94a9981811b70b0dadfe645f693ea1e8063238b0d4aa9ac8981b9fcb1355e0ae5bacbc56288353c13d2383e3ffbc21070faa99cf5988ccdfcc2f365cf0b951fa1262e65cf9106d8b39290ab5ed9cd6ca0a49e3f5692ddc0e04e1093fcd7a268020bca0c42e065f0b1266beeef40da0246a7268da6f217818338cdda3ae27f174bb4c4cdc005b4eb73c933b7a60624c193fbe77beab19692f0d43073918df6fa373af281eac174eff128e31a4aa9c31a7fb7a9086b02642d29ade34039703bcd8830a848b90a0566c04d440b0e331029373dd481b9246d1d7e20bad3df36b8b583bf35802dcca642a8edabc2dddd90afbbaf58c9f0fb78241b68bba220057f8d7aac9b08876596a1dcabd85fe11d4464aaae376e2cb0398875fabc1f63957c7ea5954ee92ad188988c446dd0c242a5448c277f14eeb0e449e953829644b9214dffc570fdce919e10b682df86b73a18b65262f7c74ad76d980b519b8b7fce0608213f37962fcde4fbdaec171510b2269f3164a37e53beca32386ebb00cf5c90062bae36947af3493c6b395e868de37b1f067153dd1818da8b06edc76599d7baf60ec911fe3a80a702aeee3054fba5c520339d9efe5009db3273e1b0861a3a4b06453a51c485096d54c435a7a37cde6378e54b33f256a1eb7931667f103b8de5372c352d19944e1d6ea75e4242220eabf699c7b646fce8706ec1916900cfe3fca591e5d99ddd6ace18d33f8006b6ef8e04cc8286fe0e1f2eaa7492533e1993f86f329fb35b18eb0e55fa8e4abaab27fbab2f31c61179b58b5d8b3c703a97ca5a2e3689ed3704bcf2874852223a01d66a58fbbbfa44da38131bd9a95ad436ac250101ece479e2ba874777f197921e69ec866b45cb45e0d9796e7c94e9c84a6ebc0c5afd29060788fbde0471acfafb916c0000d54a2c2d06c146fe5e9f2d9123021d4635d7226e1ef08d1e9698253e66435b9bac09679118408851be812d2b9d0dc72bfda9e1deb6f98c58ded0a0c6f43d92ae6cc7f7b69c8af08c9110e286fbf6ae2da919f3f80b8d5f43651e2616604e793214b017cb2ae10e43d7d1d4d01909e3318b48a10870d86196a5acb4aa92fe7b5d3aed45a04298f7c6b77fb976f2bc163574ca40091485eef7b89e62712abd2fad07206c8085088d75b5612af064dd7e6a65b1f3dd20f7344b37fe4d17277a16de8e52de337ce00eef04f443408164e50596c481aa71d9f0c6b1083cf27a10cfaf385a102a1c42fc413411fa279ae8911bba2ef616697105b3ea64ab0bf0b34934da1218b7ecd2e4318707f0b41ddf6cc670d219bdcb1777c9dde55767a9d9557f3efc21fadbb6fcdfba2218f3446e659bd342393475131b7468d492df523d3f2bcf7cfd9fa8e831fa13df9ffc57fb6840e40141eb00d8f62aeb189ec5021bfc1f8087310cd296934c0acab7fdd1575d424312eb97722d8ffc732ccd7995393c81d08999abe3a24b43472bc6eff59943b5aefe724f0d965c2d6d5afc98d96aa262686721e1f48eb75576c9d9f05761e965da20b5bb9df4b0ebb8f784389c5a764521acaddc4e8fb9c5b538ce3014cd0bfbb82c30490194b44d700aaa33cf8530678c95d2a1d81b4d821af022d0eaea436f639472fb38713d8b8beebd22234617c3e2cba8aba2c7fd422324fc76651fe9d3221216d4a9731b3653c109c71f75da28c1b5ad51d1e6f02024b21b038dabdb4164b7dfdb82232eed764c4081e0cbdaaa66182312aee490b05d311e009c5e983d54d584859b86eca2a70eda316958fb3d8b102e48ac47d754c918aac1c81f6232f6a3f64ffd60b52ae52f091d402cf20a4caba303d8fb7e4e7ea1586a865c653a2bb1674fa470fb2a13e7f2bb2d8847b07da6b50fd9fe23ee3e50e1f78e87974c7b5c5f2c6e53d11c739ce03a3fd093fd16f2ebe09cac3787bc8cc79d41808b028ec3b41db4af255e716ae2602e8f2a45e9fdcc72e1f95b6ccd2a809cefe5baa531cc9ee727c61306207d624c8d19974a90cf14f804c5e7f2edb6df21ffa1b17c74d5a9c8a3d7123541713c23f07bfd7826004592b5b8631f2a97028a2c047b71ec435f1e2ac2ada12960a496135c5b139b74e1fb1e7e6462fe7074db6972e795d95c2f8d84b4977a14093d0fb4e692724f6d8c70587fb774aa98c3f710d61e6c10a5cef95f2410b5392080549b1e9fa02f179dd206f9406f4dfd234d8ca6c7c54d85e01917f370e7221080aaa8c68734b628511037d66a0f09b3e449b695c92cb1be91b6e7d0280e06dc15e3138ba618d3ac6832c202a0dbe72b9ab1919c13d710018a5e0d2ca8abb48a065dd77e015b8b276e98c000f36d893859d8fa7245d9445b4dda083d26c8c6c9c259079247230c53ae9375de1c8acffa6db9ad777f726a458bb1edb4b0a0ea71ee7b7b76e7d22822b1f7575c9cc76e0fa150f1fc77b6a4564a46276905d32ad5cad1105d6b0706bfe4373a7844c8924b318e8057cbbea70e6f1a6d5b0af051bb9397228135c9618107d25481f6bb9f1180a22e9eb9b485654136e473b60b36b35fe26deafedf22bdf6a0e04f45356755230eff765f03580ef21ff534e7b7bc8d7e031967502ede70978efda8a3ce1841111d094003dc0a3baeec962479111ee4e54ea2b2d3553ddf073efebf24f127b19ede0275bd9dbccafc6693782d850bf048dade84a65f82b305625a8b7b274d0cf48db93cb82d0df3761308bb2a07557cf387614122c27ffa6b26d92c2c6518a8c151e19edec37f6c7f1ce747fb8f27af35ac8a417595655625285d253c6d2db20f30fb07787596dd4066a77dba0e315170d0df1b4161b471c92b3f82d5d3fdab72bab7cb029dd3a5a60bfe4e7e6545f498bfa818a15b8ebc0774df554ef7a630dd9239d3fea99f0a4aaba966b7382cdb35711e2c16dfb5caf8f6ee4793e1a2383e8ce6e85bea2282dc20628ef16e950beb376a5b8afb77390a119e5a97e5273069e87501fc298a0efd1b439523b8d85550c5039cb3524997ac076c4e9823a9e1dcf524c11ee4fa0cd967630f755e12a80539fca215ecb4599c025fd3e87a822e3ed580a64af3e562cc1d56ca739e38cdb69d5340716f555e04aee973cb34ba3ac6a91c2a6ed38111b153f6023a32422e8bd4dd88b7b270e89f421f8723e2bbc161c6489d188597efb5325406d1f0f7330fe7aefd63049c047601669aeb44468b2a6a4224f486bd014cd269664b9c9dc0057a4cffef0ff081381ce91bd84d60b3ae4536278a0ca11a6df5288ff5386995ab590820a527cc5102a207452e2547ce2b266d96e2bb35ff111f5ff41bbeb66c0a4ee951ef62aa07ba1798a75683bac79a6c8e361a320ae753776ca94ae8a1bac88b6aabcb5dab92e0519d3950c2ca58f87f63bc5138b88bcd907a2259cfd609c449e022a041a1f0acb9b6a844ddb335b605b05ca66dfba7799137468aa4070132573cd1d529647cf1cac5fa988ce049ebc0de561d7caa044b9ad26285e9199f88685bf07fabb38850af121bf461e3e00d8e499b25737c6c4e32ba4c0d2ed3039c404beffd9b399c520fbed02e1efdecc0c823672a70f713187ebd90a240c039138bac65e67381282826fe95cc63445e11e6192bc26e7c6f9e2063e4abfffd955f3987acbcef62c642cb1a65fd22eb79c5a76080963b040cb7a91fc1546077b89e0b41aff7962dfe2b51a235c718692927c11aecefc3075112b965160c9c78528642843091a9ee125b33ccbaa1f1187f4d015e68556a68f53d8ab854717d9effc917ab7a9b0603b181bcd80e03fc071496aa323b0dc3c37e110e48a817dae99e6d20603a581da705b818ebce2cb2d571eaa85939fb603762973460e8b370e1300fee5c92a96713560bb7e86b852fcbf595ac297ad479b78cefb3be88790609e91909305f87dacd196fae05a3c68f5d11d91ce796e2e2fe05baa8d9316e66ecb389140995d680cffcc101f188c55c7a86e330b51a386885327b1f2838c80e92cf33ee6fd0de33571bb1bda786c766c15f5ca8d6a03253df18f897d2ec55f456fa6074a4c38532407a0d1d440a069aeca123e1303536b49879d095b8edd164d86fa374c109fbdf45406dfcd43e646c4f2798bd690e3c32c35c0784c3c1f30b86c4d85622048f21bb6a9745d0e67ab94bca2536ad8d35d10614d1e1b0f3ccba6912637ffc229eb7cb7d95a9b69e2cd1a1830bfb567b6d6205fb7d25c236b6ce6d9efc54532496") [ 493.442342] binder: BINDER_SET_CONTEXT_MGR already set [ 493.455241] binder: 23316:23317 ioctl 40046207 0 returned -16 12:01:45 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x10]}}, 0x1c) 12:01:45 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:45 executing program 4: [ 493.497999] binder: release 23316:23317 transaction 1446 out, still active [ 493.527368] binder: undelivered TRANSACTION_COMPLETE 12:01:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce803e9"}) [ 493.569646] binder: undelivered TRANSACTION_ERROR: 29201 12:01:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x6000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:45 executing program 4: [ 493.664751] binder: undelivered TRANSACTION_ERROR: 29201 [ 493.670673] binder: send failed reply for transaction 1446, target dead [ 493.717162] binder_alloc: binder_alloc_mmap_handler: 23351 20001000-20004000 already mapped failed -16 12:01:45 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x300000000000000]}}, 0x1c) 12:01:45 executing program 5: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000180)={'syz', 0x1}, &(0x7f0000000240)="76696446a65b02652c3cbfeec966d6cc838147aaa7f59047ce91906916eebcbf475ff0d07fa372bd4fb0d774686a271181841b9694647771defc02ee3f2035c6ecf0d5e28e3a1c99acee9f5e7d8994435ba0a64d6c0ab4b59a6a5da0a797d43c6bf03127b767000a52e016c384dbcf347d4658f9cbaee64bc6d3ff2ccf4617a9b7dcc09fce2b845116c3ea56bc9f8478784ee461d1e17f3e6202ae60206926fe9ff9052722e9c0e4de844c6b38d6b840942e7314b7072446f171e9d6", 0xbc, 0x0) r1 = geteuid() fstat(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) keyctl$chown(0x4, r0, r1, r2) recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) preadv(r3, &(0x7f00000017c0), 0x1fe, 0x400000000000) ioctl$EVIOCGABS0(r3, 0x80184540, &(0x7f00000000c0)=""/170) [ 493.758104] binder: BINDER_SET_CONTEXT_MGR already set 12:01:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x500, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 493.803765] binder: 23351:23355 ioctl 40046207 0 returned -16 [ 493.818534] binder_alloc: 23351: binder_alloc_buf, no vma [ 493.831717] XFS (loop3): Invalid superblock magic number 12:01:45 executing program 4: [ 493.876402] net_ratelimit: 6 callbacks suppressed [ 493.876413] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 493.882622] binder: release 23351:23355 transaction 1450 out, still active 12:01:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x1000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce81ee9"}) 12:01:45 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x91ffffff00000000]}}, 0x1c) [ 493.965938] binder: undelivered TRANSACTION_COMPLETE [ 493.985654] binder: undelivered TRANSACTION_ERROR: 29201 [ 493.991152] binder: undelivered TRANSACTION_ERROR: 29189 12:01:46 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:46 executing program 4: 12:01:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x2000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:46 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) ioctl$NBD_SET_SIZE(0xffffffffffffffff, 0xab02, 0x100) preadv(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f00000000c0)=""/63, 0x3f}, {&(0x7f0000000100)=""/194, 0xc2}], 0x2, 0x0) ioctl$SG_NEXT_CMD_LEN(0xffffffffffffffff, 0x2283, &(0x7f0000000040)=0x8a) [ 494.058228] binder: undelivered TRANSACTION_ERROR: 29201 [ 494.063755] binder: send failed reply for transaction 1450, target dead [ 494.167360] binder_alloc: binder_alloc_mmap_handler: 23395 20001000-20004000 already mapped failed -16 [ 494.168146] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x3f00, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:46 executing program 4: [ 494.208904] binder: BINDER_SET_CONTEXT_MGR already set [ 494.229144] binder_alloc: 23395: binder_alloc_buf, no vma [ 494.256410] binder: 23395:23406 ioctl 40046207 0 returned -16 12:01:46 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x82402, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000040)=0x7ff) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="210000000300000000000000000000b90200e7ff456d14c1ead2259a0000080000"], 0x21) 12:01:46 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x9]}}, 0x1c) 12:01:46 executing program 4: [ 494.288406] binder: release 23395:23406 transaction 1455 out, still active [ 494.317179] binder: undelivered TRANSACTION_COMPLETE 12:01:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x7a000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce82fe9"}) [ 494.375173] XFS (loop3): Invalid superblock magic number [ 494.416222] binder: undelivered TRANSACTION_ERROR: 29189 [ 494.445105] binder: undelivered TRANSACTION_ERROR: 29201 [ 494.450602] binder: send failed reply for transaction 1455, target dead 12:01:46 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0xcc, r1, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x216}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x67}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xff}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x29}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast1}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x68}]}, @IPVS_CMD_ATTR_SERVICE={0x68, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast1}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x6e}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x40040}, 0x20000000) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f00000006c0)={0x0, 0x1, 0x6, [0x3f, 0x7, 0x3, 0x2, 0xffffffff, 0x7]}, &(0x7f0000000700)=0x14) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000740)={r2, 0x2}, 0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@local}}, &(0x7f00000003c0)=0xe8) fcntl$setlease(r3, 0x400, 0x1) r5 = getegid() getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000400)={{{@in=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast1}}, 0x0, @in=@multicast2}}, &(0x7f0000000500)=0xe8) r7 = getegid() write$FUSE_DIRENTPLUS(r0, &(0x7f0000000540)={0x158, 0x0, 0x4, [{{0x3, 0x0, 0x6, 0x2, 0x2, 0xfffffffffffffffd, {0x3, 0x3, 0x1000, 0x2, 0x81, 0x3, 0x86a2, 0x7, 0x25200000000000, 0x8001, 0x3ff, r4, r5, 0x80000001, 0x3}}, {0x1, 0x7, 0x13, 0x28e, '-nodev}/self\\vmnet0'}}, {{0x1, 0x3, 0xd85, 0xa0, 0x7, 0x7fff, {0x5, 0x10001, 0x6, 0x78465ece, 0x100000000, 0x4, 0x0, 0x80000000, 0x7, 0x3f, 0x9, r6, r7, 0x8764, 0x6}}, {0x4, 0x1, 0x0, 0x1}}]}, 0x158) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000780)) [ 494.518003] binder_transaction: 18 callbacks suppressed [ 494.518013] binder: 23445:23447 got reply transaction with no transaction stack 12:01:46 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667302", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:46 executing program 4: 12:01:46 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x11]}}, 0x1c) 12:01:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x4c, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:46 executing program 4: [ 494.578304] binder_alloc: binder_alloc_mmap_handler: 23445 20001000-20004000 already mapped failed -16 [ 494.589733] binder: BINDER_SET_CONTEXT_MGR already set [ 494.595235] binder: 23445:23457 got reply transaction with no transaction stack [ 494.603335] binder: release 23445:23447 transaction 1459 out, still active [ 494.611218] binder_alloc: 23445: binder_alloc_buf, no vma [ 494.616887] binder: undelivered TRANSACTION_COMPLETE [ 494.622115] binder: 23445:23447 ioctl 40046207 0 returned -16 [ 494.654583] binder: undelivered TRANSACTION_ERROR: 29201 [ 494.660138] binder: send failed reply for transaction 1459, target dead 12:01:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce843e9"}) 12:01:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x4, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:46 executing program 4: 12:01:46 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x700000000000000]}}, 0x1c) [ 494.891829] binder: 23482:23483 got reply transaction with no transaction stack [ 494.928615] binder: BINDER_SET_CONTEXT_MGR already set 12:01:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x3f00000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:46 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000000c0)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000040)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:01:46 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:46 executing program 4: [ 494.941803] binder: 23482:23493 got reply transaction with no transaction stack [ 494.954161] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 494.956857] binder_alloc: 23482: binder_alloc_buf, no vma [ 494.971195] binder: 23482:23483 ioctl 40046207 0 returned -16 [ 494.985819] binder: release 23482:23483 transaction 1464 out, still active [ 494.994320] binder: undelivered TRANSACTION_COMPLETE 12:01:47 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x1011020000000000]}}, 0x1c) 12:01:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce832e9"}) 12:01:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0xffffff7f00000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:47 executing program 4: [ 495.135112] binder: send failed reply for transaction 1464, target dead [ 495.178374] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 495.212620] XFS (loop3): Invalid superblock magic number 12:01:47 executing program 4: 12:01:47 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x8010017d00000000]}}, 0x1c) 12:01:47 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000000380)=[{{&(0x7f0000000300)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f00000000c0)=""/16, 0x10}}], 0x1, 0xfffffffffffffffe, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') ioctl$KDDELIO(r0, 0x4b35, 0x2) connect$unix(r0, &(0x7f0000000240)=@abs={0x1, 0x0, 0x4e22}, 0x6e) eventfd2(0x6, 0x80801) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)=0x7) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(r0, &(0x7f0000000200)=[{&(0x7f0000000100)=""/241, 0xf1}], 0x1, 0x400000000000) 12:01:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x20000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 495.251584] binder: 23523:23527 got reply transaction with no transaction stack [ 495.306540] binder: BINDER_SET_CONTEXT_MGR already set [ 495.323558] binder: 23523:23539 got reply transaction with no transaction stack 12:01:47 executing program 4: 12:01:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x68000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 495.348561] binder: 23523:23527 ioctl 40046207 0 returned -16 [ 495.375753] binder: release 23523:23527 transaction 1469 out, still active [ 495.389639] binder_alloc: 23523: binder_alloc_buf, no vma [ 495.434643] binder: send failed reply for transaction 1469, target dead [ 495.447888] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:47 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:47 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) clone(0x802122001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0xe, &(0x7f0000001000)=ANY=[@ANYBLOB="b700000005ed0050bfa30000000000000703000028feffff7a0af0fff8ffffff71a4f0ff00000000b7060000000000012d400500000000005504000001ed00007c040000000000002c460000000000006b0a00fe000000008500000007000000b7000000000000009500000000000000"], &(0x7f0000000080)="c1504c2f15885b9a000000000000000000"}, 0x48) syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x0) getpid() getpid() r0 = getpgrp(0x0) r1 = getuid() r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000140)='/dev/null\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000100)={0x0, 0x9, r0, 0x5, r1, 0x6, 0x2, 0xf231}) exit(0x0) ioctl$FS_IOC_SETFSLABEL(r2, 0x41009432, &(0x7f0000000280)="8c1c98faf93d8e17b95de6ff49063f0fec9fd348e1faa90b695242743b48e0d8da0407b6255dceca3b934d2a1903d91da14150c464b10d424ac3e79d8fc4639a96bcf97ecc4833b9b7b119ed5bfeb84f82cdb8dbc2c3b4b5f4a4a0dffce1ba5f94ff8e0229729e6be27204a336ea7e9c8c1687af2c73c96075539c418db4b19e35750db1b392f0586405fc422c612cbcfc28a6f6f94a242b5155a997d5c19352a61e127367f0aecb91435d6cec8c340c941727e4f2214a814048fc2ba0de9691903395e6b32dd23bac7fa74e7360a1bae0ff8c6647f1729c5f222d9613aef1f68030df5e09f76f472f5dbe4347fc5b80e58449900f8b02dc11d09852ae95d9e6") ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000001c0)=0x0) r4 = syz_open_procfs(r3, &(0x7f0000000240)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) openat(r2, &(0x7f0000000180)='./file0\x00', 0x8000, 0x40) preadv(r4, &(0x7f00000017c0), 0x1fe, 0x400000000000) getsockopt$inet_sctp6_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000040)={0x0, 0x3}, &(0x7f00000000c0)=0x8) acct(0x0) setsockopt$inet_sctp_SCTP_MAXSEG(r4, 0x84, 0xd, &(0x7f0000000100)=@assoc_id=r6, 0x4) 12:01:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce80de9"}) 12:01:47 executing program 4: 12:01:47 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xe00]}}, 0x1c) 12:01:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x6c000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 495.576853] binder: 23557:23559 got reply transaction with no transaction stack [ 495.651869] binder: BINDER_SET_CONTEXT_MGR already set 12:01:47 executing program 4: [ 495.677351] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 495.693664] binder: 23557:23575 got reply transaction with no transaction stack [ 495.721080] binder: 23557:23559 ioctl 40046207 0 returned -16 [ 495.742971] binder: release 23557:23559 transaction 1474 out, still active 12:01:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x6800, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x7fffffff, 0x30000) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x204000, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000140)={0x100000, &(0x7f0000000080), 0x1, r3, 0x8}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) 12:01:47 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x240]}}, 0x1c) 12:01:47 executing program 4: [ 495.810052] XFS (loop3): Invalid superblock magic number [ 495.844580] binder: send failed reply for transaction 1474, target dead 12:01:47 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x7a00, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 495.997807] binder: 23592:23600 got reply transaction with no transaction stack [ 496.018718] binder_alloc_mmap_handler: 3 callbacks suppressed [ 496.018736] binder_alloc: binder_alloc_mmap_handler: 23592 20001000-20004000 already mapped failed -16 [ 496.096343] binder: BINDER_SET_CONTEXT_MGR already set [ 496.121510] binder: 23592:23600 ioctl 40046207 0 returned -16 [ 496.229202] XFS (loop3): Invalid superblock magic number 12:01:48 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KVM_SET_VAPIC_ADDR(r0, 0x4008ae93, &(0x7f0000000040)=0x2000) preadv(r1, &(0x7f0000001540)=[{&(0x7f00000000c0)=""/90, 0x5a}, {&(0x7f0000000140)=""/167, 0xa7}, {&(0x7f0000000240)=""/173, 0xad}, {&(0x7f0000000300)=""/163, 0xa3}, {&(0x7f00000003c0)=""/13, 0xd}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/165, 0xa5}, {&(0x7f00000014c0)=""/77, 0x4d}], 0x8, 0x400000000000) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x119) 12:01:48 executing program 4: 12:01:48 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x1100000000000000]}}, 0x1c) 12:01:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x101000, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x4080, 0x0) ioctl$TUNSETFILTEREBPF(r2, 0x800454e1, &(0x7f00000000c0)=r3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="a2434a01ba44e8b2f2b116e11d5aff8c62420654ccf27f660771d751689f71b78e889d57ba1a9de4bdfeee8f891a4c6ac71387a52f0881850fee08c6eb16d8aa886bc1c4176104662b23b78609d188215228e0636946871231fe66e1284861f14fae8f7edbc59fbe3c85bcf724eb9b91604cb275c6df89916c51195a1055f0b6b2dc0c8abf79e1043b726ee2411cd76b15b26073432ceb40513a"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) 12:01:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x48, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:48 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667301", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 496.606339] QAT: Invalid ioctl [ 496.613568] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 496.630825] binder: 23638:23642 unknown command 21644194 12:01:48 executing program 4: 12:01:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x60, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 496.660039] binder: 23638:23642 ioctl c0306201 200001c0 returned -22 [ 496.689903] binder_alloc: binder_alloc_mmap_handler: 23638 20001000-20004000 already mapped failed -16 12:01:48 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xe8030000]}}, 0x1c) 12:01:48 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000240)={'syz0', "3adca3146934aa87d45f2a2efeefb8d7639b99eebdcedb5417e302bcadab8c9ff5c46b67d6b0ab66ee76f14b37d5728ceaa0123fe97d304ff928379513db9d437112fe2ce66b00678fe1e11a682a7dfde8a54b6ecca3a2de1679194e099e267301365e20988279e5b03f7c59782a35d9e25556e0e6424a8d48f1697109e419a75f4182367c07e8f7930578a08536558a9ebeb6ae23a5d5faea949f40edc419100b36268ddad57c6caab44cd009ec72272216d0a82245b8485f27d87111a457cabbdde6d51e4e8a19fa1960e52819bcfed2eecea7c786addcfa8b887337eb3bb627a6a008de0f23b9a5f07300b28facc39ab1a76c5cbbad1af48484c15a5b9123c195123d3936e55b9a0e1eeefb9396e254f00200e3336f3dd4fe782d071c91f92828ff4bfcff199f3cb572c61f474248997390b49a8f685d7fdcd2ef0487574045c562d5f49f71d4f0d9251850726f9cd2733b70cb514d736c3317cc9804b7948497d2bf382c18f67b5807cdffa8d39b81b2e9f110f0e77ee2f36cdd8635275d7fd94fa0051294a036e0c72b055c8a37b9d3a973e447992c5400f105d592ca6db183b0d8f8a4e51df715347dd67f544da6f2ea54601681fb13f927ac71c4cc71b4895ec21bbfa5db76f63a8762082487a91ae6dd44657de8d73d605d41a8ff404762fd5aa9a4977d754d391d4c1e1e0e227519204b4942f9f1a2e802c359af6e326cdf95049e553a9825e56f172908f480233b38afcb78e493742c1c08fe3d405b755879fe166e241ab2b8f5cecb09aefb80773ca816a98eecfb0f12e5c649f9f6c84134a8579ded983bf71f948874a47288568d51fdf70bb795f4e0d42ec0aa797588a5a575d821d2966115bb51dc1b301e868f8d148130da7d14b4798b47c85fec19bfa1bb56d5f5d33ea3b3f9c211fd9219391e35618ec96d75da06a2a0fb49b7ff8fdee5af280d361b592f538fb212fdf27c7b9b83fc9710633d1cfcf35583041282d6dafb323b9052a0d6a79dafc70b694405664cedcde067446b7bb084c92c5062e52d5c11ed50dee59496329dfffe1121ff7f9f8211148d27e2662e29454903f3f6c8b5edad3d73f2ef3580d185031402dbbde7b5617196f7136ff4c3d167f859873ae473fef3595435c5fc102e2a1c2000abf269afa225f0e10a8230549b89554cccd04f7f5ffbc2a2928ae3aa9d359def567292711cfc527b26ac363a85c690c33658911ad683f0736b10149a7c756bd914b3ad204bc469324d4a04433069828fa6b3bde54c4334fcbbd4e03cf0a0b34e0919d6b2c8c2422b0a3907d760680ed8900a5167ee86c64d763e726f8528cae12b581b5c2503b45de7e7144ae4bc2aa99492fe549fdd62e6ef9774076df52372bd59dd25a76ed8d5fd041d8916ac6e57990683cd950b6ca1f6b36a57729f35aa7e59b112df55b3775e03e420afd60ac5e59d9697469263a736b4d51b2f9d630978c4c9e6d5e9e5b6bca7355be3c530c180985eab9cf8f9ff38f69eddb7453cbe0522bcb15e519bfd340544732c84c6c5972968b6e9c0720eff19a5a66ebcd59e8fc5c1f26862bf1b5100bd4f8a333a3c45900ab7568b147c831a2d5975be755b3c1beb0646f28befb1ab6c89f3f674814738cd5fd84193343bfb4585ba6d129939359fb9f55e29fb45b4caa97d25490becf6b111a9e757cb9fafab902dedb90bd09bc2e75cce5af40e21b8e7f72acd40ba4c2bb2bd3abe0539031833d1744a3e2ac46c7c695457ee2db8f661212c97dfc8934eb1634b21d1970f02afa34fcaa4b828d0f0436f120f41f1fc2256027d1a5aa766e82d388406071116e2132c52a549e134a6fa84ae609a8c37d92eb1743d05aa00593976c08c546c6e40c528cb960d6e663f12e06375afbcc0ca2e1a2b6a1b160f0c8f44e6312fd20542844d834664193a7c4410a2d83d295eeea962b29d547d73ff655a52f59c2386c1648c0ef723fbf27c4e4e9f837147ec9451cf45af40b019df609a2851ebc1da96a614f62074b1e87085c9229db76c4fe10e10b9df6988b4ffb4b701bb86285f68df1b15a07d7e68ce0dfc627e77d6e93056beb1ef6462b5986a4c42c60422bb345d6204e2f3686c7677266c0c4f3e47489d5304f0f2e8a9b9bf9d5012c20ef5e701d47ba0f89e451773a6762c0b9fe76217b1285aae0a8fbf7609bd894eb361824a21e4a97376038bebe1966cee1b5cfb9f3dd5e6384835d4845d6a9df70e94a4ce52233297e3cfa8c8124bbe9071f685ec347f659d903bfb4a7f8159281a14336964c5aac3cc29ee6143bc443514f3b4198e1369e3fab1810ea8b7d98c13458d8c0d6c2a611d6349e94a110e9cd17e6987944d8f8f82a68e74484ed87a0f25a4da8e8e4ad2fc617831fb975d572f34061a6dd98d49dd67d130f7d822b65c12be9de3ae49a52b7a1c6274d252bc4378e99c19575b318836bf592179e698a42f5feecb19ee0a5068fb8bf63bf37171acae2ad2e34b1bc1c845b80a5ba80795c402b5b0ed3d2592a19f18e99996c68db8720c4be06797a9afeffecb7116dcb62f1550d0bcf8f671f1eb8dd1fdcbaa069b58ad18629ff59e28c1c6aae6d070064f2d6fe97c00aaa5c49e28db4c9856ee70b5d16531ecc6e59433f3eae4e3cd922199d4b6d8388d6e817f6a5d8fc24b253c6a36e77f20512ab55727e649c3564bf606e16c345c4a18a1ac05bd085165c4ec733e014b71d461779dbfa9d6657b0b114392522b5bfdf6c1b96ed8bdfe943ad954be05f8a961e109f0bc172dc7305c72b8539eb43ea78459ace1d3d0164b154bbc20508103c6192adf76b4696e764204dc75aa107b562304840df9a5ea2e8539812e347b599e2330c896b34727b44b0753c220f258fd03314d0fdaa712155777d2126f8f56c5da91565619a41fbf25f5978d21eb5de5ff77bdec6149e9ecc6e785d301bf215aab095c38d09802ee653bf8bab1fb55076214a0e833b6360fb74eec8174da6ee8545e843c79ee0ea74bd5728a4c062a8a0cfc08da6a16ef83b5f4384afd1187421c2df88928e7dd75aca7868c1a90f29655b5a038be5338dfb3479544b6526ca480ec2609705b0060f969bbc66234e255a40a3faf0b6766d77190fd7712b7c8eb38f10c39f032e518a86d43b884b0bc768bd06b33785c62db23108c46670797395805685499ac5d2991a2d7c98c7ae3202a62132988c30640f4ac8b71c339a0fdfcb179cc5bd11ffa5329130fbd7f4d56ff9c62c42e109e57e95221c19cae3b3564d46145e7fd5e6f271515b6c1b834823ff6f4ca296b6163370f92b0e57c1ce61bbed1de6547e28d1c25d651edefca71c3a7955374c309739a1465cb9efd1617cfa8ccaa43dcbdccd3b9049c6fb100018af4766dd510b49c5fbee2bd6ab39dd43afbfbd34c80f3a6b2ca450907f607f83408bbc987f491e41105559feeb98690bf167c4b1f8fc33f2ee0b77fc0b7fd11691f15015508b1efd0af3b21f84ffac7ead7fd2994ef35f9f80a64b4504a44376db85c69c8b27e0a5413a32a37a401e62be2f8527d3bb3aed22af1f87ac351b0da040b255ceb12211505e1d814fe4f4597c722bd00ed3e1151383fde9c1e3796beb520528a596659d3a8e8190866e12f60f0587af1f540fbc9a2a5bf75da56bf8f10b63515fd4973bae4356538c47e4eac1f6da83498e2a46714843dc160d240eba0cbcb84507567c79e540acd468eeea28c3d489b9b78557aeed786bdf7fa1a481db7a75256f11444a6cb732cc576da93e04b8f12f5cfda91f74c03a9c8999c4cf7e85c1d356db98d389d46c92851b30291418b618ae3f71f0abf079a44c1e9a55ffeb001569e7a8e1a622b5a2fa05270ed5c8fef64affcc54339872722d906c4f3b167408372eaee305562c6d78d616465418450a5282ab2daa0beba2a3b569ccc1bb7a5b61b66f5676fa84ae768d29d000e7b805d4b0c8bd1cb440df654f34fd7772e2567c5afa14fb05195650a6f87cbef10846f710fc717616dc9c4dd6c00cb24d1d653d1640b55e80cc70d13aec4f7654fe27327da1692adc2e01be5a9b1c049f56b3ad8d650f3864777615dcef1656d279da34ac990dbae11891b9d8d8a04506b593af362a89caf7334f82c5feeaa639fa5b0c61929595d8c2b6148b6d187aa74fb735807ea24a7317fc6aeb55b1ed64ea4ffc38ade63898a36939a145a97e4b54f6bfe7e0c84d55e05b15b91917209428cbf23723392b6d1dc5a302a46e65b319fa4000fbba700a33bc5f61402c0c7fde8332925b4333a5c58cdd0c16a1f2fc979e28a392f077a8f7840bafa6d18173a4769f54947ade72f6048f9d1f1b2026484324c1cbbc6f2c39307be3fcb4c000b1e5a60bdba0604009bda9c7728e335b7c30279c5236b429912cbab094ef91ea20d8a02a38ffd4e63d019bdeeb3d01dc13af4943ddff76bc2c02f607d70d37e49e3aa4b2a0f8fd12366aef81c8411b7f78103fd1e7179f5b6786a4bfe7ee37e41619a35bc044d5c254e8ab8bc70a5df789cee2480fd5fbf9551aaaff4d53f2fde0ddd17c01c6e61699152069a5527e95a9f19668a28336e57d1c4813ca097e07f51c8c1796ce30b925500cba4af491a5b987dd46719ff05e3975335c40a91766d276e7f920607abaa6bd462430bea1ce43356ecb75d527a0385a980d253acab91535cd9a943ef0e14d4392a5f596bc81990e6e38363aad8415f009a69bf4e41f2c8332f125ff54e1ae66d0e83327cb4418f91454eee0f68cad8293c01dd6a68865deb2d2ba0c329fcc34d2247d569b1c35828f1f80bfea6994b39eb5aeec24b9e1f8601200eaa3c78b81523af54e802a3b0a859ec79bfe16788701e7fe873223b66f213c436d3e6bf7b55d74ccaa2b4559532ff4112ec5a233261397db4d5f5c1ebc4c93a12ab219fb0375360b51f359b19e5b468b3a2b6d8caef21f8ffc34f86fde9e3f765d645f8726f520c40f10339b9452a69151c573f8a825fb94e12e8bf0c5e96fdc0768c3144df09074bb50572e17f766ab6ae382b701a8abd61e139c0e3f6e0cb1be7ddb0961fbeda693762fbfc51dae52e184d14c62fcbbbd263ad55d8b45817161a7cb59b902be0501a7fe097c943eab9609889dfdc811043f97a9d74b8b6fa82286cc197a8eba7210c33e168e7255d331b53a13d7d479060eda3f82c4e7138a5f22e07e1450bdd0df126d0d06ba3bce7006ecf7f7754eefc55f420fe116614f27dc07d4225e846631d2be53ee0b8362f786cf88a275f2545e844c1df98d58e3e60502b3cef4fed4dd1972fb68001a8327e6de2cf10b4c43433681845640fc4f885c51d86c20ca50ab6bad08afa0855705b8dbd63bd6dd1efbe3365d4ef022eb77141a5ca423ed05f2d8b85ae30df945d7f0bdedcf3d4df467b941250f83f92d91717ca7d77b5dfe54a3cd8da4a8109ff8a3eaf75185c5e7249b7b3c3beca47c939aba21491d47a05ecbe46d2ac1b71171bfd1308d1543671c787a74f175b49f2640a045e41208dfb60deadf36170144dfc2bf16b187a3e53cd9d863e4290694d423027db68dda1fb290634de10d1d5e37e338d087baeca2b4fe4ef03007e03b1351b543d8dfa866bb09683b2436054235b4798a67e27c5b1cba388d06b0c59fa58752f45ad6e358ef7ac9dead190e18de5fa9c64284a3eaf9970b7b6b7a10f536ff626f7f3bf09ad36d619c19f508983d9ed4e8da442f4192cf221c39ebf3e28561a09133a093873a414c997d330141b1295730704bff2a654ef7749776bf23f7f1fbb15305389fe7b16adf80561f3358f"}, 0x1004) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 496.745969] binder: BINDER_SET_CONTEXT_MGR already set [ 496.765446] binder: 23638:23642 ioctl 40046207 0 returned -16 [ 496.792279] QAT: Invalid ioctl 12:01:48 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x100000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:48 executing program 4: [ 496.829533] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 496.829541] binder_alloc: 23638: binder_alloc_buf, no vma [ 496.851734] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 496.861403] binder_thread_release: 1 callbacks suppressed [ 496.861414] binder: release 23638:23642 transaction 1483 out, still active 12:01:48 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x91ffffff]}}, 0x1c) [ 496.874864] binder_release_work: 3 callbacks suppressed [ 496.874870] binder: undelivered TRANSACTION_COMPLETE 12:01:48 executing program 4: 12:01:48 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) io_submit(0x0, 0x0, &(0x7f0000000780)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/audio\x00', 0x200000, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt(0xffffffffffffffff, 0x3, 0x1, &(0x7f00000003c0), 0x0) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x4f0d000000000000, 0x3ef, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x1103, 0x4000000001000000, 0x0, 0x0, 0x0, 0x6]}}) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000240)) ioctl$VT_DISALLOCATE(r1, 0x5608) ioctl$sock_inet6_SIOCADDRT(r2, 0x89a0, &(0x7f0000000100)={@local, @empty, @loopback, 0x3}) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000440)) r4 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x3, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00001ec000)="0a0775b0d5e383e5b3b60ced5c54", 0xe) r5 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhci\x00', 0x400000, 0x0) fcntl$getown(r4, 0x9) getpgid(0x0) stat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000002ac0)={{{@in=@remote, @in=@rand_addr}}, {{@in=@multicast1}, 0x0, @in=@remote}}, &(0x7f00000003c0)=0xe8) getpid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000005e40)={0xffffffffffffffff, r5, 0x0, 0xa, &(0x7f0000005e00)='/dev/vhci\x00'}, 0x30) ioctl$TIOCGPGRP(r5, 0x540f, &(0x7f0000007680)) stat(&(0x7f00000076c0)='./file0\x00', &(0x7f0000007700)) getegid() sendmsg$netlink(r5, &(0x7f0000007840)={&(0x7f0000000280)=@kern={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000007600)=[{&(0x7f0000007500)={0x10, 0x1a, 0x100, 0x70bd29, 0x25dfdbfd}, 0x10}], 0x1, &(0x7f0000007780)=ANY=[@ANYBLOB="0000000c51000001e4ffff0000000000", @ANYRES32=r2, @ANYRES32=r3, @ANYRES32=r0, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32=r1, @ANYRES32=r3], 0x30, 0x4000001}, 0x4000000) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r5, 0x84, 0x8, &(0x7f00000001c0), &(0x7f0000000200)=0x4) r6 = accept$alg(r0, 0x0, 0x0) io_setup(0x2, &(0x7f0000479000)=0x0) io_submit(r7, 0x1, &(0x7f0000738000)=[&(0x7f0000f73fc0)={0x0, 0x0, 0x0, 0x3, 0x0, r6, &(0x7f0000000140)="c4427aa1afb6c4394b7f24a10591dd4391", 0x11, 0x2a}]) openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000080), &(0x7f00000000c0)=0x8) 12:01:49 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x11a9, 0x3ffffffffffd) 12:01:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x48000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 497.064683] binder_send_failed_reply: 1 callbacks suppressed [ 497.064728] binder: send failed reply for transaction 1483, target dead 12:01:49 executing program 4: 12:01:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x7400, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:49 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x900]}}, 0x1c) [ 497.206455] XFS (loop3): Invalid superblock magic number 12:01:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x5, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 497.294238] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:49 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:49 executing program 4: 12:01:49 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x8b37631600000000]}}, 0x1c) 12:01:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x6800000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:49 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 497.559089] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:49 executing program 4: 12:01:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x700000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:49 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xea9655ed00000000]}}, 0x1c) 12:01:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x240, 0x0, 0xfffffffffffffffe, 0x0, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="484008102ba4c1cba501492a93be7a8eb1fbb4f41bfa7819a104341c624f6de734000000006e6465e5fadc08000000000000035d929571aecc79"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r2, 0x0, 0x485, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f0000000100)={&(0x7f00000000c0)=[0x9695, 0x5, 0x2, 0x6, 0x7, 0x7, 0x2], 0x7, 0x401, 0x3, 0x4, 0x8e7, 0xec, {0x200, 0xd194, 0x4, 0xbd58, 0x9, 0xe3, 0x7, 0x3, 0x8, 0x3, 0x3, 0x0, 0x4, 0x1000, "fd01b4338822dd8cbcc59f8d76635b725f17a4d1082839550a7a37183b9a21d3"}}) 12:01:49 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040), &(0x7f00000000c0)=0xb) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e22, 0x4, @mcast2, 0x339f}}}, &(0x7f00000001c0)=0x84) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000240)=@assoc_value={r2, 0x7}, &(0x7f0000000280)=0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) accept$alg(r0, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 497.743201] XFS (loop3): Invalid superblock magic number 12:01:49 executing program 4: 12:01:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x3000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 497.881668] binder: 23771:23776 ioctl c0306201 20000440 returned -14 [ 497.919784] binder: 23771:23776 unknown command 268976200 12:01:49 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:49 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0xb8ff0000]}}, 0x1c) 12:01:49 executing program 4: [ 497.940236] binder: 23771:23776 ioctl c0306201 200001c0 returned -22 12:01:49 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x3) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 498.011251] binder_alloc: binder_alloc_mmap_handler: 23771 20001000-20004000 already mapped failed -16 [ 498.045400] binder: BINDER_SET_CONTEXT_MGR already set [ 498.055120] binder: 23771:23780 ioctl c0306201 20000440 returned -14 12:01:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x60000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:50 executing program 4: [ 498.102295] binder: 23771:23776 ioctl 40046207 0 returned -16 [ 498.104975] binder: 23771:23791 unknown command 268976200 [ 498.141387] binder: 23771:23791 ioctl c0306201 200001c0 returned -22 12:01:50 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x700]}}, 0x1c) 12:01:50 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = fcntl$getown(0xffffffffffffffff, 0x9) r1 = syz_open_procfs(r0, &(0x7f0000000040)='loginuid\x00') setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000000)=0x5, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 498.180113] XFS (loop3): Invalid superblock magic number 12:01:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x8) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{}], 0x1, 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.origin\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) 12:01:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x68, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 498.302016] binder_transaction: 24 callbacks suppressed [ 498.302034] binder: 23817:23823 transaction failed 29189/-22, size 0-0 line 2834 12:01:50 executing program 4: [ 498.346868] binder: 23817:23828 transaction failed 29189/-22, size 0-0 line 2834 [ 498.348259] binder_release_work: 14 callbacks suppressed [ 498.348266] binder: undelivered TRANSACTION_ERROR: 29189 12:01:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x200000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:50 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="786673f6", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 498.393634] binder: undelivered TRANSACTION_ERROR: 29189 12:01:50 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x6000000]}}, 0x1c) 12:01:50 executing program 4: 12:01:50 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) fstatfs(r0, &(0x7f00000000c0)=""/99) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000040)=0xfb0, 0x4) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(r0, 0x111, 0x4, 0x0, 0x4) 12:01:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x200000020012, r1, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) mbind(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, &(0x7f0000000040)=0x12000000000000, 0x4, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) 12:01:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x4800, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:50 executing program 4: 12:01:50 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0xffb8]}}, 0x1c) [ 498.690001] binder_alloc: 23856: binder_alloc_buf, no vma [ 498.718530] binder: 23856:23860 transaction failed 29189/-3, size 0-0 line 2973 12:01:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x4800000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 498.761085] binder: 23856:23860 got reply transaction with no transaction stack 12:01:50 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000001c0)="b7f2288a911993f0265df5cf1cdd06d692f130088866528b55b062950b86bc01", 0x20) r1 = accept$alg(r0, 0x0, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[], 0xffffffaa) recvmmsg(r1, &(0x7f0000005a00)=[{{&(0x7f0000001bc0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x7c0, &(0x7f0000001e00)=[{&(0x7f0000001c40)=""/180, 0x34000}], 0x1, &(0x7f0000001e40)=""/213, 0xd5}}], 0x400002d, 0x0, &(0x7f0000005c00)={0x77359400}) 12:01:50 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0xffffffff00000000]}}, 0x1c) 12:01:50 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 498.805837] binder: 23856:23860 transaction failed 29201/-71, size 0-0 line 2741 [ 498.834189] binder: BINDER_SET_CONTEXT_MGR already set 12:01:50 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) ioctl$ASHMEM_GET_SIZE(r0, 0x7704, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000040)={0x0, 0x6}, &(0x7f00000000c0)=0x8) ioctl$BLKSECDISCARD(r0, 0x127d, &(0x7f0000000140)=0x2e) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000100)={r1, 0x2}, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400207) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 498.880425] binder: 23856:23860 ioctl 40046207 0 returned -16 [ 498.884585] binder_alloc: 23856: binder_alloc_buf, no vma [ 498.891936] binder: 23856:23870 transaction failed 29189/-3, size 0-0 line 2973 12:01:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x400000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 498.949983] net_ratelimit: 4 callbacks suppressed [ 498.949993] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000002000000000000000000000000000000000160000000000000000000000001891c470751c4c809dbd9ec4500529896d3a427ba0eb22dee7c0fc388a4348bd96ef7af7f35dcd8c4ea7b9d7653699fcd7bc53536e715a8af150bad190ecd3ccb15a21d25baa20fafab3fdb8efb61db199c113cca827ef9537671c2a042229dd6f178167027e1e5ab7597db407a680a196e8e968982de2fd10c78c75c9a962df1d2d66d3ba45813eeaffb3a6872b432aa95c2ff86d936b6b0985a8efa56424cdfa", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000040)={0x200000000000, 0x100, 0x80, 0xffff, 0x1ff, 0x8}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000300)="bce854e9"}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x100000000, 0x8000) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000400)='/dev/hwrng\x00', 0x80001, 0x0) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000140)={0x2, 0x2}) recvfrom$inet6(r2, &(0x7f0000000340)=""/162, 0xa2, 0x40000060, &(0x7f00000001c0)={0xa, 0x4e24, 0x28, @dev={0xfe, 0x80, [], 0x17}, 0x1}, 0x1c) r3 = inotify_add_watch(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x14000100) inotify_rm_watch(r2, r3) [ 499.035442] binder: undelivered TRANSACTION_ERROR: 29189 [ 499.065415] binder: undelivered TRANSACTION_ERROR: 29201 [ 499.075250] XFS (loop3): Invalid superblock magic number 12:01:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x7400000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:51 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x2000000]}}, 0x1c) [ 499.081521] binder: undelivered TRANSACTION_ERROR: 29189 [ 499.179927] binder: 23912:23919 transaction failed 29189/-22, size 369098752-0 line 2834 [ 499.212050] binder: 23912:23919 ioctl 40286608 20000040 returned -22 12:01:51 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x200000002, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) 12:01:51 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 499.240229] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 499.242889] binder: 23912:23919 transaction failed 29201/-71, size 0-0 line 2741 [ 499.260969] binder: BINDER_SET_CONTEXT_MGR already set [ 499.266673] binder: 23912:23919 ioctl 40046207 0 returned -16 [ 499.275592] binder_alloc: binder_alloc_mmap_handler: 23912 20001000-20004000 already mapped failed -16 [ 499.285376] binder: BINDER_SET_CONTEXT_MGR already set 12:01:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x600000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 499.305458] binder: 23912:23919 ioctl 40046207 0 returned -16 [ 499.353680] binder: 23912:23925 transaction failed 29189/-22, size 369098752-0 line 2834 12:01:51 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x7000000]}}, 0x1c) [ 499.396426] binder: 23912:23934 ioctl 40286608 20000040 returned -22 [ 499.417512] binder: BINDER_SET_CONTEXT_MGR already set [ 499.471291] binder: undelivered TRANSACTION_ERROR: 29189 [ 499.478128] binder: 23912:23942 ioctl 40046207 0 returned -16 [ 499.534876] binder: undelivered TRANSACTION_ERROR: 29201 [ 499.548213] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 499.566094] XFS (loop3): Invalid superblock magic number [ 499.574692] binder: undelivered TRANSACTION_ERROR: 29189 12:01:52 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'echainiv(ccm(serpent))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00001ec000), 0x0) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, &(0x7f0000000040)={0x1, [0x0]}, 0x6) r1 = accept$alg(r0, 0x0, 0x0) write$binfmt_elf32(r1, &(0x7f0000000040)=ANY=[], 0xfffffca1) recvmmsg(r1, &(0x7f0000004e00)=[{{&(0x7f0000000300)=@xdp, 0x80, &(0x7f00000004c0), 0x0, &(0x7f0000000000)}}, {{&(0x7f0000000380)=@rc, 0x80, &(0x7f0000000140)=[{&(0x7f0000000400)=""/156, 0x9c}], 0x1, &(0x7f0000004040)=""/224, 0xe0}}], 0x2, 0x0, &(0x7f00000002c0)={0x77359400}) 12:01:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x4c00000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:52 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x15, &(0x7f00000001c0)='lotrustedlovboxnet1-\x00', 0xffffffffffffffff}, 0x30) r1 = fcntl$getown(0xffffffffffffffff, 0x9) r2 = syz_open_procfs(r1, &(0x7f0000000100)='limits\x00') write$smack_current(r0, &(0x7f0000000000)='net/ip_ir\acache\x00', 0x10) ioctl$ASHMEM_PURGE_ALL_CACHES(r2, 0x770a, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000680)=[@in6={0xa, 0x4e24, 0x4, @dev={0xfe, 0x80, [], 0x18}, 0xa98f}, @in6={0xa, 0x9, 0x6000000000000000, @remote, 0x20}, @in={0x2, 0x4e22, @local}, @in={0x2, 0x4e22, @multicast1}, @in6={0xa, 0x4e23, 0xec, @mcast1, 0x7}, @in={0x2, 0x4e23, @multicast2}, @in={0x2, 0x4e21, @loopback}, @in6={0xa, 0x4e24, 0x9, @mcast1, 0xffff}, @in6={0xa, 0x4e22, 0x3f, @dev={0xfe, 0x80, [], 0x1c}, 0x2}], 0xcc) r3 = inotify_add_watch(r2, &(0x7f0000000040)='./file0\x00', 0x500) inotify_rm_watch(r2, r3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x5, 0xcc, 0x9}, 0x2c) r6 = bpf$MAP_CREATE(0x0, &(0x7f00004f9fe4)={0xc, 0x4, 0x4, 0x100000001, 0x0, r5}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r5, 0x28, &(0x7f00000000c0)}, 0xffffffffffffffe7) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000000)={r6, &(0x7f00000001c0), &(0x7f0000000080)}, 0x20) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x4) preadv(r2, &(0x7f00000017c0), 0x1fe, 0x400000000000) ioctl$KVM_SET_XSAVE(r2, 0x5000aea5, &(0x7f0000000280)={"8ebcd067773c877aaf975a8951ef9a322e828fc3598dea1af1afab61886b199ee5cfb94e0cbe7198edf8eb000ad8dbb19e62798183c312706262dfd24eac17478e95ba36df90e35130664d7a12564501d57946142588072cea6e073cd2bbcebf2038169a387bb68b6c92b2e9a0462fde09440477bfe1b1d89bcb7b3f3a33e37808500511a5214ce7d76828b3901eddd68f7db42cd8c1707d25463ba1d75233bb016073576df967bc2c1d8ed5e40c811ec23ed8664e4a1c41df7021906eca2035a541acce2822ab414be9110005c6760f751894d12269334cdc70a5c34832431668ac7db0a697908996bdb0078ccca3b78f8043cfe3c0d05701a78880c7e5c61e64aee08dff85a330b97b2438461a2a82e58607ef05e8e9e9697b614e110e572f8e408a581cd38897919576f0dbf4c81dfa1a9acd004f2c737e5b858515675cb709ff5d9561d567d8b4dbc5237c9ec48aa1891ab73e3b84657b652e3e992ed7cf8c37df9e6f4f97fd39dc42cf219f66dbbb2c5df4c74eb68fae47003a4fce73986a62e76569b70eee4322f79b68d6f6d3c99454ae51a80fbf2378db9281578b2f56239145097530c09c6298873b76b1c6fd6e0df1e24ca3e84423d95e4efa7cec0a113f387dd0f09017fafb50c968f388048ffeddbcdd29f536a27a4b31abda3c7db7baf2f7e09449c9e0097810b528671f8137f98746e56d864559eba3fd8271992c8e199d2bed94ec5446306e0db11c6e29a02f7d54f5abd2b328bad9ec4e1fbd42206162124ebb434b0834f0cfa2d8848aa31ba54f3ad1d2ac7c314e805246e5f50ea40909aba3899fd44993cdd7a82a348f6dcc54bd7fa5fb141b0f7bde524771f092f4c5b633fcd5ee802e346005511bfa382c596989ade43ecb3a3a3d4bab747a6ab339e7a3889a480b132b8011fbe3e46b287c28715022f545487f1e846984ca343f34f93f2670f2eee8c65961a89c37b7cd11a11b2ea39e6b430a35d1fe1309466c98d80f7af70d79a47dd885300f89ff192ea98b5c923a3683ace0fcd809a1a3fe08c4005d5f560a6a0e826ab931e492b4685eba900482e0cb437029c893d8a4f3ee02128a141a3df8241b44af7292dc64ba6dcc050de4b4fb8f43575e1bf8c95128964195e3b32d8050fcc438521442cb965f2b2ce90f506733e50a84023b4ab335d9d18e82b309fdf138e1c629c4f264d961ad4a121f9b2e5aec3b560bc28ff36f8476fac9345a3539fec4d84f61f67addaf20af5d24ff8f8563ee46dc74170cb5f1fa1e23d519c00258386545417bb9dfad66ff0d205d726fe28910587945419054dd4c164672e40c0abf0e833c0970c39a74a555af8c1cbf95e599883ba707650edaf87172bf0aa9e6f0fe5c08d195232886577b315c47171643e81874f2b7271dedae542ea20d7980aa902db8f24c0ec8e87838f1d761f63ed9"}) 12:01:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup(r1) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r2, 0x118, 0x1, &(0x7f0000000040)=0x5, 0x4) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000080)={0x18, 0x0, {0x3, @local, 'tunl0\x00'}}, 0x1e) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) 12:01:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x3000000]}}, 0x1c) 12:01:52 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 500.847463] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 500.867549] binder_transaction: 1 callbacks suppressed [ 500.867558] binder: 23971:23976 got reply transaction with no transaction stack 12:01:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x74000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x54]}}, 0x1c) 12:01:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x74, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 500.920897] binder: 23971:23976 transaction failed 29201/-71, size 0-0 line 2741 [ 500.951302] binder_alloc: binder_alloc_mmap_handler: 23971 20001000-20004000 already mapped failed -16 12:01:52 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCMBIS(r0, 0x5416, &(0x7f00000001c0)=0x6) r2 = getpgid(0xffffffffffffffff) ptrace$peekuser(0x3, r2, 0x40) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000240)={0x0, r1, 0x401, 0x1, 0x26f, 0x7}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) socket$unix(0x1, 0x1, 0x0) lsetxattr$security_evm(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='security.evm\x00', &(0x7f0000000100)=@v2={0x7, 0x3, 0x9, 0x5, 0x98, "6360f0b193aa2d743125667b21c41245a031a71d8a1f735be5453d1eed38d5765cc08b68792ab03ade51055e4448920e1b3b7b5a68f4c6dc7b08f948b43ce2eab435ab4f411715465ba45215d3f30f66f2664e24e612cd49256f850d18856f17802fbab61e750bc30dbc668fec8737a192f5900e7e46a6f46e936463236b0bc476abcd1df26b0ddf9450fdaf527f5ad7a7f4809bb8e3c6bd"}, 0xa2, 0x2) acct(&(0x7f00000002c0)='./file0\x00') [ 500.996089] binder: BINDER_SET_CONTEXT_MGR already set [ 501.001088] XFS (loop3): Invalid superblock magic number [ 501.021272] binder: 23971:23976 ioctl 40046207 0 returned -16 [ 501.042624] binder_alloc: 23971: binder_alloc_buf, no vma [ 501.063183] binder: 23971:24003 transaction failed 29189/-3, size 0-0 line 2973 12:01:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x300000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 501.101009] binder: 23971:23976 got reply transaction with no transaction stack [ 501.119509] binder: release 23971:23976 transaction 1497 out, still active [ 501.134210] binder: undelivered TRANSACTION_COMPLETE 12:01:53 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x2000000000000]}}, 0x1c) [ 501.161933] binder: undelivered TRANSACTION_ERROR: 29201 [ 501.224735] binder: undelivered TRANSACTION_ERROR: 29189 [ 501.264702] binder: send failed reply for transaction 1497, target dead [ 501.296496] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:53 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000100)={0x4, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r3, 0x4018aee1, &(0x7f0000000000)={0x0, 0x2000000001, 0x1, &(0x7f0000000240)}) 12:01:53 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667302", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="ea08e3249ce8718227c712634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) 12:01:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x2000000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:53 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(r1, &(0x7f0000000040), 0x0, 0x400000000000) 12:01:53 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x142800]}}, 0x1c) [ 501.498749] binder: 24052:24061 unknown command 618858730 [ 501.514623] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:53 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f00000000c0)={0x3, &(0x7f0000000040)=[{0x87, 0x800, 0xf164, 0x5283}, {0x5e, 0x7fffffff, 0x2, 0x800}, {0x5, 0x9, 0x9, 0xf283}]}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)) [ 501.543935] binder: 24052:24061 ioctl c0306201 200001c0 returned -22 [ 501.566513] binder_alloc: binder_alloc_mmap_handler: 24052 20001000-20004000 already mapped failed -16 12:01:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x4c000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:53 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0xfc]}}, 0x1c) [ 501.595373] binder: BINDER_SET_CONTEXT_MGR already set [ 501.619708] binder: 24052:24061 ioctl 40046207 0 returned -16 [ 501.643923] binder: 24052:24079 unknown command 618858730 12:01:53 executing program 4: socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname(r0, &(0x7f00000002c0)=@pptp={0x18, 0x2, {0x0, @multicast1}}, &(0x7f00000001c0)=0x80) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x6, 0x100000000000031, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') r2 = syz_open_procfs(0x0, &(0x7f0000000200)="6c6f67696e7569640039dad3c444de4a35f0fd223db6aa1e2fdd63c9f35f389e4669e0af6522c225bbb645ae9e0f46c87cd44db4919c1a34ab1d00bb4157f79b23912e9b96566ebf23618dfdd331fcacfeccdb938974f48d420c49e5b37f94bdb651b9c102659034f4192f") sendfile(r1, r2, &(0x7f00000000c0), 0x1) io_submit(0x0, 0x0, &(0x7f00000006c0)) ioctl$DRM_IOCTL_MARK_BUFS(0xffffffffffffffff, 0x40206417, &(0x7f0000000180)) pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000280)) write(r4, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000100)) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) syz_open_dev$sg(&(0x7f0000000640)='/dev/sg#\x00', 0x0, 0x0) setpriority(0x0, 0x0, 0x3) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000340)={0x0, 0x80000001, 0x30}, &(0x7f0000000380)=0xc) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(0x0, 0x1004000000016) [ 501.669395] binder_alloc: 24052: binder_alloc_buf, no vma 12:01:53 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 501.703884] binder: release 24052:24061 transaction 1502 out, still active [ 501.717032] binder: 24052:24079 ioctl c0306201 200001c0 returned -22 [ 501.723678] binder: undelivered TRANSACTION_COMPLETE 12:01:53 executing program 5: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x20000, 0x0) ioctl$EXT4_IOC_RESIZE_FS(r0, 0x40086610, &(0x7f0000000100)=0x7ff) recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:01:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x802) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x123000, 0x0) ioctl$BLKROGET(r1, 0x125e, &(0x7f0000000080)) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = mmap$binder(&(0x7f0000002000/0x200000)=nil, 0x200000, 0x2, 0x2010, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000140)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000180)={0x0}) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000001540)={0x0, 0xfff, 0x100, {0x2, 0x1}, {0x6, 0x10001}, @cond=[{0x2, 0x40, 0x6, 0x3, 0x6, 0x100000000}, {0xfffffffffffffff7, 0x80000001, 0x0, 0x7, 0x2, 0x81}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, r3, 0x1}, @decrefs={0x40046307, 0x3}, @increfs_done={0x40106308, r4, 0x1}, @transaction_sg={0x40486311, {{0x1, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x18, 0x10, &(0x7f0000000200)=[@flat={0x73622a85, 0x1, r5, 0x4}], &(0x7f0000000240)=[0x38, 0x38]}, 0x100}}], 0x1000, 0x0, &(0x7f0000000540)="c9c2e838f655bc608cfa84cf1fa7158c60cdf0927956fe4f5e895ca405aea84a3bdd0e0117b520e6f88f5a499a1678fd565068a3e0d15c4b5af4278e9e927ac67c67c69d80430a8ff4599093df99533f4102c08aee31e68091acfd5fc2b19cddf926ae5c68aa5396af8afe589391b691bbb65046c9b87a80b23f6ed3a2c96066d39a4e7410744cf39526bad35d84186a14703e1f083818158ccedb74f1d978de97bac6fb6ad7d67fb2e3a05cd329657efa039dc2a935fc3b7cc61ef1a0067548b3037f8dd8152b80e302874e9bcc7683a9ce0d25322eeb4b97f7731e55a7c42a23f3ccc0dd89f98f04fd08694eab6ba56511bdb8d78824724c30d63001a3c1d4b605a8b0a33e7bfef654d22b563a3c729a9a53cada1eb9efeb80cc33b011f39fa3a85d952fdfcbf3f339e174abc430ddcc596c86a1448e1e12234db6d010562b8617449f2a76ce4e7256ae5ec310671bfb41ae03c81c5f90f777f79aebcd35d029aaf3aa4efc15cff213d4c44710b4efa7b27fcd8dd3abf0942b98c729d710a1c3c59a4ae5c1bfff35e55310fdae74383f9d4ddf237d974ada080a5a739f0d2a7381add64476fd1cebfcfa56aab2a89a6acb4502387f1e5dffec1c79b8e7301528c04abf53407fa27c6d6cd88a796446edc533d6ac64d796f53422216751395f9685ad9ce118c24c93a17d43118b4fd98cfa8fa94c91a5ef31b56b3c09aa2e9963d45e44ceb89e857486e56ae45359f1219580ac97c759b310d621fe6ffdea71ea8c06a78b9e239c20c38bf0507ba8eb9c45d9392b2bf778d3e47b83bfae5654c1a075bd8e5283390eb23cc1b82d23dfcbf121268553a41a1b51c7f666331931dee37aa459847deb8b7c471641005a969e193d6c014c4b73584fb8da73ef5befccb5b49783aebaa480ef7532dda2d467f22c687a1b420c1af45d74f1a27875f0a0063acd232e0c8ca36b9ceaf4c7de4e2d340b9c082bf68fc9e85cbc08468fa2c11927adac8b15cde7fe44af0b6f78ebcc78061477cdc031e1eb400fa1ebdf37e03c39434af9586dbcb00880a57fbb4dd0d4a5b6d4fa2d4e1a6f156f1c8a69e79352f5fa81221158d2d1113e656f29299c01960879caf41b4c937785715a9c0cf4a02258c1c2473cb69825bdcae6809340f7b139d676e9bb9494e2e19814a6cbde6906b6c324bafb76dc4ec92e2a53bb667e584c45b2c5d069e5e33e647902dae474a2c46400529a6fed7c1d31a2a5b4cb32ae55c31274696b58b0f728349ffe3ffbae6c4ccc403fad3ac3639ea3cc2849393c56db11ccccc7cda6464234ce5a7e36cc93f1e9907e70a2bb37020a9370324e0a02ea82be03039b0587b8299707f820de5a981dfae8a39daca3ccbd35375541e6b481587caaf97fc56e871b103cb166c3ecd537cdf61734fb3dbe15231fd52e1c5dc1e1433276c70a7b1fb2aa2fcf7eabea2cd216184b14c6c021c524d4b2d8542d79a07f1145ef4bca25958451e9e7c0ea49f96d7088b96b02ffd5a08ad22877cebd98583c71d8b98c0e04461719ed94935198c37d5c11d7f36de8ee32c56e1352486814ebb1e11857745dc3b690c5c22705e43839564e50c892be6a236f6420398bbeb3627190ecec1b1b148f40d1d939f3e6af942cf7480073d0203b441835d9984344132328bd8211f5f78dc8bef6caa85e4adb7f048f5e746613994ca05c51e79504acd03899226a1c3b7254adf26387686d49804ab1468813c03620358ddfa7e49153375b781f9228ac02ed09d86a633cfcfc996eb1a3105b8302691ae1de2ee252c1538c269eb63306c32610fc3f8bcd6de79d13b2fe43fd00d763da1bb3152362e000a8d0ce06b167e5edda8601b98f6d660f899f56399e8150caf0fb38b7092b4e5bc9c80cedde0d80c60b6cc1c8150615ec79585e0bc95216ebbea4698d7fe7dded7280f37dd6d08185bb68947459c1e7bdc31f7dc69d8760b826cd3cf1f90084cdcdd4c1222eca5fc492bce1fcd2fa69fb964db6d29cae5487f10bafb0dda143280ed8e115199cfea54acff8fe523fbbf071f2ecac64b05e0b210a3c7d6d2eb4c06342f3d87640f70def64c1513930739a4d55cac410d006a40202b576fbd1d9a23042da7b2711ff32cea2daabe7233e8dfbbe16c35e51f63b295fb37b3008c4c93fb5f4d7dfb5023935add2c8bf60c2640fc329a849a338123012e6c14ad17182a39a6a28db04f9f84135b4d0100c067dad4b9d8c3be9bc26d48e085a353a67e6d5f8267249db33b78ddcd170840043835707862210fee2afe2692da20c487cddf7f57711b5f9219597a9d03ca49732f1b332a2b8a2ab835adae8e234f46b06d6098d45134aee7047791016365e6a893d38cfd397c2b89d873b61797a550f6b41b4225cba19b3c7421b855c48735bfe54000245c9034b626cb89d1761123ef19d08c8664a6f1b4023ce480f21b6a78403102bd4b14399b05b2e29f07f049ca104863971e6d9a010d87d3bf59c2590fed0eb31b6aa9b63551767a83a1df0fb47674b7dd00cbaeb19b532f40811c60b87c9589e295aeb7802a296869568cc6b31fbfe312d45e4bcf7e504939a4f2f9451bc33e9237de811252e8520dc9961634462f5cddec6393ed6c6fe3ef1445731d3d697780981f64c444d986b0bb3c24653cfa9f5bdb929d424f2ab21f5fa10f3e68f8ff63875118d5cfcb14abef39e8498dbc28238532088985de1dba272a25a7b90755fc6e4959bb96043b1c82061adc6520645bcb2a4437ea9f4fc298f806afce59a132e260c2f9f86e68412db2f504870d5f3801c9985d11dd54d127122fafbb4bc868f03d1cfd367f00b3a09213b7451d7d24d037ca25e43181025c37a6e9737513c0c0d942d2701e32debd33e69b80da9cc47cf469908a0e760a68c5dabecb959382934bc19f73bbf6e72763f7bccea0b4c769f9be286f10757d7ce9840057e51c9f63d15eb60f9e7ba0a9621083682fe0e654a8fe743f3d05fcbc4bda0f13f210c903d172f7a0026b2ba224d1cfb128b8b50e837f88579fb6a34cb1485aa6392d29e075d61e6540592e23fcb8175892afa1f13790a859d31651ace00a50246265f0e743cddae6decea35d7ac0a4150899bd210bfc952463d14214d20a5301d598d68cdb187f26012229f35d7fd48f4da1224e31f2dc5362fb7c0b7736142fca277ac22c71ce0ab06b88206dd29d00541029adaf242174c7807419873ab79ad21ab690fbb192a99a4918b7ad2e6af4c5aaef725c05c70438640755f2e3cbeb80fef954a1ba806c13dffc1b9cb4e48f481c082994ffd3cc683cf8f281dc37edd16e0feb9384c3eb51af8d7dc6b39448cb8c2afcfdd25c4de35dd572f261fd921b3b5b800aee5ffab9c0a7dbcc004073cbcf1194b2931e4acf42ec3812dd5e554b0b4e63b61399b1bff90d301374580a994c01882c35447ebe8a0e111d41d3da9724d7807249e390bbe0eff7c324407f813052547b313a3adabde2f8c097fe0d8c9921dc85c0316eab248c8e4937474da12174691a1d57a9e81081caf28bd8cd8ea128736717b2a7780edaa5f3b0b3c047edbcbcdaa6079c186a82a246158b9466407e63075aba35afe4027a34539fd7ff2de5e0e533ac31e96ce210ce5cecb4a5f88d403555fe257c8991ca4af76ac93ac8f0b2fd0ecc6dc0f4f71e4b3c702057b11c3546923652dd1bdd8b163921556af63e37b5c968f57c53fbb524a037196c8c4cf44fd0527a70b21b09599df2d83eefb84ff9ab785e60b4397db67acbd6175e625d564206ca41b67a503fcf9c0f1a02753811ee82ba373d75f6b413dc3d1728bfe2d6d234e2fa6f236021a0b9f3cb7d79808ef67920a6b8ad2bc1c23832805a4423c772d13ca5f66007ca805926c641a7b54c1e27c1155e614dd693ed707adb01ea4f3882a80306448e8319e46b7d30a250141f6195bdd9bbcaa043e5163648d4f07aa59cd66acbc80d72ea2a942e23718a5f9c7f2e06f208e48497656570c5aab0f95469ad5403603f8092dc3a55c846cf3311b95110e89508f06f1734f0a59b2d34cb098cc9491564e0e84cc430715ebb696816fde3413564b5cdc3f370219739f95863034e951ba8e38fa4fcc44bfea8fa06e48aee88180dfd257983c728445a0a8a078c3e5cdfd6329b0a13f21f88075d3a1e7ef73ab8fc3c77bd6d6d29ee18ccd5d9d459b4bb3caa585c97b93225bdc533101840dfd225c22f32c53f16fd846edee122e15e94693c1246040191eef6b6e5bda08f923e72d518e5943214a55dc8e5cfe7ca128e84b22e9e76cc8c533e2f93b73132012761c056f47b9044b12499f7a02d86adc17efef0c36656989d4021b4e077944db498a570f7b72d5ffff75a90fb2a429380421bcbd50696f53ec4de510e41cdd5de62cb59506adb7e4bbdd6f5c9216ffb9e88c9b43f6f12ad5265c33c6721e75beb5b7a6c7cb314bee4560623adc6e1e5cb79c855a5c32156027c6d958a5c6020a5d9f5d0444af5518c340ef83c51048042630567fea44cc7eb3158d6e7c871356b2b02a2cb61c51e54cea9839ceb8ad4c5df255dcd18639b51a3d235db46385579dfdcd171b9140626659e27bd90da6bd93bc3b4f761b4e766f72fd73d51e72adc4ae3f7f85d6273ff4548cdafff66f9e26e427127ff96b74cc74c4b900715400942988e6bb5af8c6f2a005476a190556159027a5abfe919d5301b132856d623c99341372343c09acc64b302e1866df4458f28fe97bdf8d5054c1572621088b3d156d6094c5fd198df7dfd50f901581254617cafc4dd9b8dde5fcd489b76fb1bc64edcbeda75a7e7addd0b6012c1edbf596e45a500aad6863933f28541a4b8eada50012dbb2688cc06fbd0c742ee6fd060266cd20a9a133c10cf55b8495d39999942d21c9cef59e7e51ffc6253b111969a5c035f770be313c9be36b081703cc0498b9cf9513d49fac55afc453919db43fe6d5f81de35f512bf206c72a2ac18f269c6613d38ce89f941718137636bbeb6f10ee5fe0bfa7cea7b5c8f573ca73a1ff61ed5ffee851984c019ad162ff9cbd07cb3aae51624f7c53a346d207cc771728b3388354f89d6e69e341f0c4619a57a9d05a5873b34e5af91734a70b37118ac772aa80e82d9c2ae22de21e56a2c3307389385748018dc24c6ff01a4822b027f7424c8612b65125ca268477d761224cc8ac53f9025210e4537df81ebd7a70fa247fedf3d5c3dfad68d83c4fdaf9448492cf62be634421bc790d55cdf1900b44e333b8fcd3ce6185ee9f7c51ee9a958c82262f7017baf9cbc5db85c63844b0d0ce214c870028bbac779cfe1d4776366083a01d142cc72834c7732e07691a93a711de43d93ccc3878146be18a8c3b72c6b556f2e5fe18586753a9a48690fd49119e203b1a15fd108c1a914d01c42c77bffff1b7ca31842107b38a24f786c584f35a059951cae3a3b2e2ac85c1ac147235abe4ee88fa6f4713dddce0b4c5e2d3471b570fdade49da8d4e4da40fa701a6b0b0ab99bc00e29811f657f19b1ec8f6c4c59c111e13a2f954b5ed7538856228073c876af1321047ee79cbd8b7fc45c45fe5fdbfc52d3e5cbcaa9fae2737235ab453160fd76fb4502f0129306370e2848299002ff683615eaeb459e2645e0612318afbfeb549ac863e6aeb7406095e4c51f06ff11c18713973a8959186f2561fa666b37b9c92ae911f40b6c552389304e30684b3f8c69554e9a48480a23550179aaa77ac6483de00fa850ac7661f60d50b5ae278bbb3f3b7d7b8526fcac2a117b3b75e55328ad32f4c28fefd5618c8"}) poll(&(0x7f0000000000)=[{r2}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) setsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f00000004c0)={0x3, 0x1, 0x20, 0x8}, 0x8) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f00000003c0)={0x4, [0x4, 0x2, 0x91ed, 0x7]}, &(0x7f0000000400)=0xc) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000001580)={0x8, 0xe4, 0xfffffffffffffff9, 0x2, 0x7ff}, 0x14) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) [ 501.785430] binder: send failed reply for transaction 1502, target dead 12:01:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0xffffff7f, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:53 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x600000000000000]}}, 0x1c) [ 501.897964] binder: 24097:24102 BC_INCREFS_DONE u0000000000000000 no match [ 501.930300] binder: 24097:24102 DecRefs 0 refcount change on invalid ref 3 ret -22 [ 501.967776] binder: 24097:24102 BC_INCREFS_DONE u0000000000000000 no match [ 501.993869] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 502.000744] binder: 24097:24117 got reply transaction with no transaction stack [ 502.011800] XFS (loop3): Invalid superblock magic number 12:01:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x4c00, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 502.040748] binder: 24097:24102 got transaction to invalid handle [ 502.064871] binder_alloc: binder_alloc_mmap_handler: 24097 20001000-20004000 already mapped failed -16 12:01:54 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$getownex(r0, 0x10, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:01:54 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x5000000000000]}}, 0x1c) [ 502.090309] binder: BINDER_SET_CONTEXT_MGR already set [ 502.096647] binder: 24097:24126 BC_INCREFS_DONE u0000000000000000 no match [ 502.126417] binder: 24097:24102 ioctl 40046207 0 returned -16 [ 502.138561] binder: 24097:24126 DecRefs 0 refcount change on invalid ref 3 ret -22 12:01:54 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 502.165898] binder: 24097:24133 got reply transaction with no transaction stack [ 502.205045] binder: 24097:24126 BC_INCREFS_DONE u0000000000000000 no match 12:01:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x5000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 502.239901] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 502.240721] binder: 24097:24126 got transaction to invalid handle 12:01:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$KVM_GET_EMULATED_CPUID(r2, 0xc008ae09, &(0x7f0000000540)=""/4096) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) close(r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) [ 502.457983] binder_alloc: 24151: binder_alloc_buf, no vma [ 502.497806] binder: send failed reply for transaction 1512 to 24151:24155 [ 502.509811] XFS (loop3): Invalid superblock magic number [ 502.525167] binder: undelivered TRANSACTION_COMPLETE 12:01:54 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x2000000000000000]}}, 0x1c) 12:01:54 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$nl_netfilter(0x10, 0x3, 0xc) preadv(r0, &(0x7f00000001c0), 0x0, 0x400000000000) 12:01:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x2000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) rmdir(&(0x7f0000000040)='./file0\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x37d, 0x0, &(0x7f00000000c0)=ANY=[@ANYRES16=r0, @ANYPTR=&(0x7f0000000140)=ANY=[@ANYRES32=r1, @ANYRESDEC, @ANYPTR=&(0x7f0000000080)=ANY=[@ANYRESOCT=0x0, @ANYPTR64, @ANYPTR, @ANYRES16=r0], @ANYRES16=r0, @ANYRES64=r0, @ANYBLOB="093a826ea3493a877300eb5e3459f0c5e6f6da6d4a6285cf7c81543493", @ANYRESOCT=r0, @ANYRESHEX=r1], @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES64=r0, @ANYPTR64, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="191faedf0429501647241400f97dbe6c9177322436a9fd052e32e25d8eb36e827fecdeb8c53f1a347c5209e8a279efedba05f95ecdc0ba97da9e1dd68a4e7f664ffcf9d8951df06b1af166d99894ddf98cb0166a90dec8b320b38a4b1c3da65f912c8a8f12bd099732cbe5002c9ec8ec725c17a45b342b1605afa15c2329df7682d0ffb197e25fc6779b960526d95eb07745731ef6cb18bd2cb823ceda0f0864134e06ddc723a76b02b020671244c4", @ANYRES16=r1, @ANYRESOCT=r1], @ANYRES32=r1, @ANYRESOCT=r1, @ANYRES64=r0, @ANYRES64=r0], 0x4, 0x0, &(0x7f0000000380)="09aab7768f3c6880aae9924503b5f5993f226be74acab8c6ae9f1df7393110e731d03dcd335b591546424095b691beb012d3afe4880f01df85417cf3b9ea6d2daada351005362e6b11e83d0d0d537f0959034d"}) 12:01:54 executing program 4: socket$inet6(0xa, 0x0, 0x34eb) r0 = perf_event_open(&(0x7f0000000180)={0x100000000000002, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$GETVAL(0x0, 0x0, 0xc, &(0x7f0000000100)=""/56) clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) request_key(&(0x7f000000aff5)='asymmetric\x00', &(0x7f0000001ffb), &(0x7f0000001fee)="520972697374e3637573677256696f3a4465", 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000040)={0x0, 0x7f, 0x9, 0x7ff}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00000003c0)={r1, 0x8}, &(0x7f0000000280)=0x8) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f00000002c0)={0x3, 0x400040, 0x100, 0x6, 0x4}) 12:01:54 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 502.754032] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 502.782302] binder: 24181:24182 unknown command 20971523 12:01:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x600, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:54 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0xfc00000000000000]}}, 0x1c) [ 502.808213] binder: 24181:24182 ioctl c0306201 200001c0 returned -22 [ 502.843450] binder_alloc: binder_alloc_mmap_handler: 24181 20001000-20004000 already mapped failed -16 12:01:54 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x1) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 502.889256] binder: BINDER_SET_CONTEXT_MGR already set [ 502.912863] binder: 24181:24182 ioctl 40046207 0 returned -16 12:01:54 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) io_submit(0x0, 0x0, &(0x7f0000000780)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/audio\x00', 0x200000, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt(0xffffffffffffffff, 0x3, 0x1, &(0x7f00000003c0), 0x0) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x4f0d000000000000, 0x3ef, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x1103, 0x4000000001000000, 0x0, 0x0, 0x0, 0x6]}}) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000240)) ioctl$VT_DISALLOCATE(r1, 0x5608) ioctl$sock_inet6_SIOCADDRT(r2, 0x89a0, &(0x7f0000000100)={@local, @empty, @loopback, 0x3}) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000440)) r4 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x3, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00001ec000)="0a0775b0d5e383e5b3b60ced5c54", 0xe) r5 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhci\x00', 0x400000, 0x0) fcntl$getown(r4, 0x9) getpgid(0x0) stat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000002ac0)={{{@in=@remote, @in=@rand_addr}}, {{@in=@multicast1}, 0x0, @in=@remote}}, &(0x7f00000003c0)=0xe8) getpid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000005e40)={0xffffffffffffffff, r5, 0x0, 0xa, &(0x7f0000005e00)='/dev/vhci\x00'}, 0x30) ioctl$TIOCGPGRP(r5, 0x540f, &(0x7f0000007680)) stat(&(0x7f00000076c0)='./file0\x00', &(0x7f0000007700)) getegid() sendmsg$netlink(r5, &(0x7f0000007840)={&(0x7f0000000280)=@kern={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000007600)=[{&(0x7f0000007500)={0x10, 0x1a, 0x100, 0x70bd29, 0x25dfdbfd}, 0x10}], 0x1, &(0x7f0000007780)=ANY=[@ANYBLOB="0000000c51000001e4ffff0000000000", @ANYRES32=r2, @ANYRES32=r3, @ANYRES32=r0, @ANYRES32=r4, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32=r1, @ANYRES32=r3], 0x30, 0x4000001}, 0x4000000) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r5, 0x84, 0x8, &(0x7f00000001c0), &(0x7f0000000200)=0x4) r6 = accept$alg(r0, 0x0, 0x0) io_setup(0x2, &(0x7f0000479000)=0x0) io_submit(r7, 0x1, &(0x7f0000738000)=[&(0x7f0000f73fc0)={0x0, 0x0, 0x0, 0x3, 0x0, r6, &(0x7f0000000140)="c4427aa1afb6c4394b7f24a10591dd4391", 0x11, 0x2a}]) openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000080), &(0x7f00000000c0)=0x8) 12:01:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x6c00, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 502.955067] binder: release 24181:24182 transaction 1516 out, still active [ 502.966161] binder: undelivered TRANSACTION_COMPLETE [ 502.976661] XFS (loop3): Invalid superblock magic number [ 502.986002] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000040)=0x8001) 12:01:55 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0xffffffffffffff63}], 0x1, &(0x7f0000002e40)=""/16, 0xa7}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ppp\x00', 0x412001, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f00000000c0)={0x10000000, 0x0, 0x2}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) r3 = semget$private(0x0, 0x3, 0x104) semctl$SETALL(r3, 0x0, 0x11, &(0x7f0000000040)=[0x800, 0x0, 0x8693, 0x8, 0x8, 0x2]) ioctl$TIOCSBRK(r1, 0x5427) 12:01:55 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x577390f870]}}, 0x1c) [ 503.104729] binder: send failed reply for transaction 1516, target dead 12:01:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x6, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 503.188994] binder: 24235:24238 got reply transaction with no transaction stack [ 503.257208] binder: 24235:24243 ioctl 40087602 20000040 returned -22 [ 503.296045] binder_alloc: binder_alloc_mmap_handler: 24235 20001000-20004000 already mapped failed -16 12:01:55 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x1f4]}}, 0x1c) 12:01:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x7a, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 503.332095] binder: BINDER_SET_CONTEXT_MGR already set [ 503.350013] binder: 24235:24238 ioctl 40046207 0 returned -16 [ 503.366705] binder_alloc: 24235: binder_alloc_buf, no vma 12:01:55 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:55 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x418080, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000140)={@local, @broadcast, r0}, 0xc) getsockopt$inet_sctp6_SCTP_INITMSG(r3, 0x84, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x8) [ 503.375398] binder: 24235:24254 got reply transaction with no transaction stack [ 503.395590] binder_transaction: 10 callbacks suppressed [ 503.395607] binder: 24235:24243 transaction failed 29189/-3, size 0-0 line 2973 12:01:55 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x500]}}, 0x1c) [ 503.453641] binder: 24235:24238 ioctl 40087602 20000040 returned -22 [ 503.460689] binder: release 24235:24238 transaction 1518 out, still active [ 503.474763] binder: 24235:24254 transaction failed 29201/-71, size 0-0 line 2741 [ 503.485090] binder: undelivered TRANSACTION_COMPLETE 12:01:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 503.535545] binder_release_work: 8 callbacks suppressed [ 503.535552] binder: undelivered TRANSACTION_ERROR: 29201 12:01:55 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x80fe]}}, 0x1c) 12:01:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='trusted.overlay.origin\x00', &(0x7f0000000280)='y\x00', 0x2, 0x2) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup3(r1, r0, 0x80000) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x80000, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000180)={0x2, r3}) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) lsetxattr$trusted_overlay_redirect(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.redirect\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) [ 503.579373] binder: send failed reply for transaction 1518, target dead 12:01:55 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0xb8ff]}}, 0x1c) [ 503.674719] binder: undelivered TRANSACTION_ERROR: 29201 [ 503.680275] binder: undelivered TRANSACTION_ERROR: 29189 [ 503.714408] binder: 24276:24285 unknown command 64 12:01:55 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) getpgid(0x0) r0 = getpid() r1 = syz_open_procfs(r0, &(0x7f0000000000)='net/arp\x00') ioctl$sock_inet_SIOCSIFBRDADDR(r1, 0x891a, &(0x7f0000000040)={'tunl0\x00', {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x10}}}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:01:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce82ce9"}) [ 503.734213] binder: 24276:24285 ioctl c0306201 200001c0 returned -22 12:01:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x7a00000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:55 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0xa00000000000000]}}, 0x1c) [ 503.791718] binder: 24280:24292 ioctl 4008af20 20000180 returned -22 [ 503.815940] binder: 24280:24292 got transaction to context manager from process owning it [ 503.829304] XFS (loop3): Invalid superblock magic number [ 503.870515] binder: 24280:24292 transaction failed 29201/-22, size 0-0 line 2825 [ 503.880754] binder: BINDER_SET_CONTEXT_MGR already set [ 503.913445] binder: 24280:24302 got reply transaction with no transaction stack [ 503.924862] binder: 24296:24301 ioctl 40046207 0 returned -16 [ 503.939164] binder: 24280:24302 transaction failed 29201/-71, size 0-0 line 2741 12:01:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x500000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 503.961914] binder: BINDER_SET_CONTEXT_MGR already set [ 503.974044] binder: 24280:24302 ioctl 40046207 0 returned -16 [ 503.974880] binder_alloc: 24280: binder_alloc_buf, no vma [ 503.988264] binder: 24296:24301 transaction failed 29189/-3, size 0-0 line 2973 [ 504.007417] binder: 24280:24292 ioctl 4008af20 20000180 returned -22 12:01:56 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667302", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:56 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:01:56 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x16000000]}}, 0x1c) [ 504.008522] binder: 24296:24301 got reply transaction with no transaction stack [ 504.016830] binder_alloc: 24280: binder_alloc_buf, no vma [ 504.070092] binder: 24296:24301 transaction failed 29201/-71, size 0-0 line 2741 [ 504.088763] net_ratelimit: 2 callbacks suppressed [ 504.088773] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 504.106082] binder: 24280:24302 transaction failed 29189/-3, size 0-0 line 2973 [ 504.144648] binder: undelivered TRANSACTION_ERROR: 29201 [ 504.150194] binder: undelivered TRANSACTION_ERROR: 29201 12:01:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x3f000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:56 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x8dffffff]}}, 0x1c) [ 504.185007] binder: undelivered TRANSACTION_ERROR: 29189 12:01:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) 12:01:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce82ce9"}) [ 504.284758] binder: undelivered TRANSACTION_ERROR: 29189 [ 504.290446] binder: undelivered TRANSACTION_ERROR: 29201 12:01:56 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000040)={0x3, [0x0, 0x0, 0x0]}, &(0x7f00000000c0)=0x10) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000100)={r1, 0x2}, &(0x7f0000000140)=0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) lsetxattr$trusted_overlay_nlink(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000240)={'U-', 0x3}, 0x28, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:01:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x6c00000000000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:56 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0xfe80]}}, 0x1c) [ 504.384808] binder: 24342:24350 got reply transaction with no transaction stack [ 504.416309] binder: BINDER_SET_CONTEXT_MGR already set [ 504.419373] binder: 24342:24350 transaction failed 29201/-71, size 0-0 line 2741 [ 504.421620] binder: 24349:24353 ioctl 40046207 0 returned -16 12:01:56 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667303", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 504.499477] binder: 24349:24353 got reply transaction with no transaction stack [ 504.504378] binder_alloc: binder_alloc_mmap_handler: 24342 20001000-20002000 already mapped failed -16 [ 504.536038] binder: 24349:24353 transaction failed 29201/-71, size 0-0 line 2741 [ 504.544357] binder: BINDER_SET_CONTEXT_MGR already set 12:01:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x6000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:56 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x1663378b]}}, 0x1c) 12:01:56 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 504.571146] binder: 24342:24350 ioctl 40046207 0 returned -16 [ 504.588945] binder: release 24349:24353 transaction 1531 out, still active [ 504.599014] binder: undelivered TRANSACTION_COMPLETE [ 504.607179] binder: 24342:24371 transaction failed 29201/-71, size 0-0 line 2741 [ 504.638156] binder_alloc: 24342: binder_alloc_buf, no vma 12:01:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce82ce9"}) [ 504.685522] binder: release 24342:24350 transaction 1529 out, still active [ 504.702921] binder: undelivered TRANSACTION_COMPLETE 12:01:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x4000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/dev\x00') getpeername$netlink(r2, &(0x7f0000000080), &(0x7f00000000c0)=0xc) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00of', @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="01000000ceb3727c71032aafb6ef464e189c198ff8f757a80ef841cd9da8b29451bc4db10f22f51fc3e1604d55b480fabde9a82847284d7c2bd741fb77432f9f1d87a5193c62f3e4c62d3f55467f380143d36415dccf005e8e96000000"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) [ 504.765536] binder: undelivered TRANSACTION_ERROR: 29201 [ 504.794701] binder: undelivered TRANSACTION_ERROR: 29201 [ 504.802123] binder: BINDER_SET_CONTEXT_MGR already set 12:01:56 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x5bb42]}}, 0x1c) 12:01:56 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000100)={0x0, 0x3, 0x9, 0x2, 0xdc, 0x4d}, &(0x7f0000000180)=0x14) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000240)={r2, 0xf1, "b5d4f77d130ce710619ca84411dd17f950dd906c1265571397d97c3391fe24fa3cfea6c59039084f6faa027066b1c1d8b303574b5321737b73b5db704b6dbb55ccd09c0edcf0fd7b5fba78f217ac24fe08c4e7e2b16f035a080933e334fd19dacafc3fec7e878f3d68076e0d192812cb9ba1275465508fdb6cc793c215bfc6d2d59088088b7e03699256f5bfd10b30761f6fffee7b09e4ce87d67dbc688c8c4df21ffa7cefcb8a92ac799040a928ea429028e37b640e31c464c1bf255f65b046251b1ef931d398711d0d5770aa9f94b4db7df5c7fa4cf824c63eb33a4b99f20ab7dbce4fc5f1d04fa602f269c671b02303"}, &(0x7f00000001c0)=0xf9) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f00000000c0)={&(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7}) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000140)={0x1, 0x2}, 0x374) [ 504.821871] binder: 24384:24390 ioctl 40046207 0 returned -16 12:01:56 executing program 4: r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x6, 0x40000) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000040)={0x4, {{0xa, 0x4e23, 0x4, @dev={0xfe, 0x80, [], 0x11}, 0x6}}, {{0xa, 0x4e24, 0x101, @local, 0xffffffffffffff9c}}}, 0x108) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000240)) r3 = syz_open_procfs(0x0, &(0x7f000051d000)='ns/user\x00') r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r0, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000300)=[@text16={0x10, &(0x7f0000000280)="660f2abef3150f2136ba2100b000eeba4200b80f00ef0fc7aa0078dc5e006766c7442400000000006766c74424029f0000006766c744240600000000670f01142436660f3a420e910000b82f010f00d8ea09002b01", 0x55}], 0x1, 0x4, &(0x7f0000000340)=[@efer={0x2, 0x8100}], 0x1) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000500)=[@text32={0x20, &(0x7f0000000180)="c4e2699711c4c10c566b1a66b814010f00d80fc71f0fc7280f01dfdbc4b9800000c00f3235000800000f30c4e1f914a2b40000000fc76db3", 0x38}], 0x1, 0x0, &(0x7f0000000340), 0x0) getsockopt$inet_mreq(r4, 0x0, 0x24, &(0x7f00000003c0)={@local, @local}, &(0x7f0000000200)=0x29e) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xd, 0x2010, r3, 0x180000000) [ 504.874573] binder: send failed reply for transaction 1529, target dead [ 504.881394] binder: send failed reply for transaction 1531, target dead [ 504.884161] binder: 24393:24395 unknown command 4219648 [ 504.896358] binder: 24393:24395 ioctl c0306201 20000440 returned -22 12:01:56 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667303", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 504.930605] binder: 24393:24395 unknown command 1 12:01:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x300, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 504.994317] binder: 24393:24395 ioctl c0306201 200001c0 returned -22 [ 505.033902] binder_alloc: binder_alloc_mmap_handler: 24393 20001000-20004000 already mapped failed -16 12:01:57 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x8dffffff00000000]}}, 0x1c) [ 505.069911] binder: BINDER_SET_CONTEXT_MGR already set [ 505.097861] binder: 24393:24395 ioctl 40046207 0 returned -16 [ 505.112983] binder: 24393:24410 unknown command 4219648 [ 505.133898] binder: 24393:24423 unknown command 1 12:01:57 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 505.154202] binder: 24393:24410 ioctl c0306201 20000440 returned -22 [ 505.170269] binder: 24393:24423 ioctl c0306201 200001c0 returned -22 [ 505.187995] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x6c, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x84, 0x0, &(0x7f0000000540)=[@register_looper, @acquire={0x40046305, 0x2}, @exit_looper, @acquire={0x40046305, 0x1}, @release={0x40046306, 0x2}, @reply_sg={0x40486312, {{0x2, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f00000004c0)=[0x30]}, 0x80000000}}, @reply={0x40406301, {0x1, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x78, 0x20, &(0x7f0000000200)=[@ptr={0x70742a85, 0x0, &(0x7f00000000c0), 0x1, 0x4, 0x3b}, @ptr={0x70742a85, 0x1, &(0x7f0000000140), 0x1, 0x1, 0x8}, @ptr={0x70742a85, 0x0, &(0x7f0000000180), 0x1, 0x2, 0x2}], &(0x7f0000000280)=[0x20, 0x40, 0x38, 0x40]}}, @free_buffer={0x40086303, r2}], 0x256, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) 12:01:57 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\n', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:57 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0xe803000000000000]}}, 0x1c) 12:01:57 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = open$dir(&(0x7f0000000000)='./file0\x00', 0x200000, 0x88) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x0, 0x0) linkat(r1, &(0x7f0000000040)='./file0\x00', r2, &(0x7f00000000c0)='./file0\x00', 0x1400) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100000c7, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/ip_vs_stats\x00') preadv(r3, &(0x7f0000000480), 0x1000000000000117, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000140)=0x14) [ 505.365527] binder: 24441:24442 ERROR: BC_REGISTER_LOOPER called without request [ 505.418707] binder: 24441:24442 Acquire 1 refcount change on invalid ref 2 ret -22 [ 505.454724] binder: 24441:24442 Acquire 1 refcount change on invalid ref 1 ret -22 12:01:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x7000000, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 505.471884] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 505.485343] binder: 24441:24442 Release 1 refcount change on invalid ref 2 ret -22 [ 505.509397] binder_alloc: binder_alloc_mmap_handler: 24441 20001000-20004000 already mapped failed -16 12:01:57 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 505.571056] binder: BINDER_SET_CONTEXT_MGR already set [ 505.598861] binder: 24441:24463 ioctl 40046207 0 returned -16 12:01:57 executing program 4: mkdir(&(0x7f0000027000)='./file0\x00', 0x0) mount(&(0x7f0000033ff4), &(0x7f000000fff8)='./file0\x00', &(0x7f0000032ffb)='fuse\x00', 0x7ffbf, &(0x7f0000032000)) r0 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) write$P9_RWALK(r0, &(0x7f0000000000)={0x3d, 0x6f, 0x1, {0x4, [{0x8, 0x0, 0x6}, {0x2, 0x0, 0x4}, {0x0, 0x1, 0x4}, {0x54, 0x3, 0x8}]}}, 0x3d) 12:01:57 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x70f8907357000000]}}, 0x1c) [ 505.616054] binder: 24441:24464 ERROR: BC_REGISTER_LOOPER called without request 12:01:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x700, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 505.655694] binder: 24441:24464 Acquire 1 refcount change on invalid ref 2 ret -22 [ 505.674636] binder: 24441:24464 Acquire 1 refcount change on invalid ref 1 ret -22 12:01:57 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 505.750673] binder: 24441:24464 Release 1 refcount change on invalid ref 2 ret -22 12:01:57 executing program 4: socket$inet6(0xa, 0x3, 0x6) openat$tun(0xffffffffffffff9c, &(0x7f0000000800)='/dev/net/tun\x00', 0x0, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f0000000740), &(0x7f0000000780)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffbff, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000880)={@un=@abs={0x1, 0x0, 0x4e21}, {&(0x7f0000000680)=""/183, 0xb7}, &(0x7f0000000300), 0x3}, 0xa0) ioctl$KVM_GET_NESTED_STATE(0xffffffffffffffff, 0xc080aebe, &(0x7f0000000ec0)={0x0, 0x0, 0x2080}) creat(&(0x7f0000000340)='./file0\x00', 0x0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(0xffffffffffffffff, 0x800448d3, &(0x7f0000000440)={{0x0, 0x0, 0xfffffffeffffffff, 0xfffffffffffffffb, 0x0, 0x6c}, 0x0, 0x0, 0x40, 0x80, 0x0, "892b88a58ee0619c0fcb2249d803e68b5036b542677216b71d34357d4f08663646bfd7bf632415a9013cf9a7bc59d0cbfacc1000baa35129737111e2e2b2f1941714f3c6cbc97316666215de505bfc138a153fc6a97d90f0e26103d616f669f56883d961d3ba19c1a3d63aa959e14124b19cfb28fa498385a6af9a81d4f5840e"}) socket(0x40000000015, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000007c0), 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00006dbffc)=0x400, 0x4) r1 = add_key$user(&(0x7f0000000500)='user\x00', &(0x7f0000000540)={'syz'}, &(0x7f0000002f40)="47d9205cd97c5cb006715f8e051f3ea54de1e11347817087132af65a0445e2640f871f24742817652f3340cbcafabff776ca8da5ac21739ccc11aa8e4b01a6d6f9913fcbf67f162aadcff3c1d5aa273588aa93156d6a4be34548f511260b8f6cdf538eb8c748dbbd1cdb91317c95ec317a7b9459cab391f1dddc5213b5069eb4b2341ecdb6e0d2809500fdc1256566b4902b473fba3c4c4b7e02c068447e64929368213424f0f741eaf8059645ddc2a1aa7dea762692d1e04f7a71005d6f8cb8928b295c65e85c7aa0dfcc4b04e51299c7e74848f399a7e0a3ad6c19f4442a7849bbd23a0c1401a86084c81809d04e943027d056d2b8173e0fe8ab4b79c72a668bfab4c840924e8fe4e77b17466354d62b6db810277cd7a42f92deb7bac1792a5ba561e99ac3b4ccec9d66be1fb475669d2f6e193fbb08383359351dec71a1f64b1a9ba476b3ca7be294c14abaf19ee1a908cb678acc3c02b1c1cc66f77a8bedcf0099cef051c354514dd8ca8e29ae3c5902bb3f5b0b6a8d7b297da59f6fa18e354ef5ff9a05445428c3465dcb4a3d849b3f1c0bbe4a7439aa140636bb0eb8ef15240841ccef78a75783825e9beb85100351915eb51cf71f4a8e8028b5846b410650e8e1face1069a4a6c1ce11b0b1770bfe6a4fc3ea923da5177f35f6713e3f2964391a54b310542678f6f2b89606900e5bb59f14542b65ad1a7ff36cae874fc88cfa4df3761dd337cfe40eb68fefb9919b6d199216e81781763bda9b94e51d35900fde24359d1b31e285589cec1c73ffe42ab174eb800c6c21155b4f8c5e3e317ab8985332358ceec2d9dd46c6ce9a1fa1133af2c006acfca72965d00af9e5baca64a5e3e67c43731050d285351fd8cfb013e05061d9d77e48a7dc0f708ebec379262f6772719ac1bcf548a05e661859c2f3a1210ea11065d251915f71213716db0a128ad47421089dd6dce1e2434099a83a75ac17d3beef4c94a9692a586463920958a790d913fbdcc0fcbea2b6e5bd9ba9b3958cc0ee46f6b976d5b06464ab2acb2030956a273ea2d8a59a5c25ce6a70a3f456a0ff8e57e7e13a701c2999f82f8fd98f0c96155db3b1c4d02e5032cdb30321e0c5576c4ea9cf427e43488244baf7d202ef9089f74ec13fc0ae2ead057dd80277cb1641c89dfc7a9cc664652ed21e36c57693e190343a1e2c9d218e6602d18b506b704474990e53a5712c5a94d36953cd414fea9377bf70c825e0245273db8c22bb8bacd552c70a94ff607b7e3099ada4052dc575e407c79184d72bee329366eb70aaa4f3f7dae1ba4155b132f5666a55eb8983a4271c0c83fd53cb3fe24295dec7d725e3d504cd576cd0124033772ac6706b240bc81622d21867b1661fd16464111e553d79825f6c6030eb34b29a44b9d9e0e8b18c5484c1133400a3c8358a6aa4cf143c45d993b3524b3af373b270e3cf475611da457c25f52d2ceb8a8e45f6872ce1a4dedb66493b705682b694fdeff02efb130f78e1f230bb5481ae0ababd942d35a17683b7b0feee57123e982cb687203dbabf8fb411a35673c1e471328bf0db41fc0f27a6cdb4edea1b614fc4016e3fa81459a8c5e3952abef502edfc6ab659d160ce525a05ae4216b56252ffc1c0d6bc8e5baa63f6b172605fa8e10e9824119ae68a405654f0c308a6a6cae79820fc9967ccd521a889db7452462f592a5b97852bce8dec167ce20d95a387267c5b0b4b3633a88a0376459fc35314c88c9f48ea6db3a4269361d62b2b8d4f39d7d6abdf1233c122bdd2788aad2853bb525ae946bb031eb3f5e24a4adbaedbbf5fdfc6d8b21221ba76f693e5e32de85f87b78d37a2a683afa77d5a91bff4e235d5d09a27bd64da9a08ff212df12c6a298aafdf74f1cc854d915794677e4dcf3a5028bc6bd87a1b1e14d6cd59c8b632eeccb61578249bf900d13a3d4fa350be013f210639f4add4f7d51de6ba9d1e822f8a58db8d52e39b27082b176f78ecd5efebfa3f501f220e1209335c48938d64c9cad7029f5a8bd547295b17a1327ddfa7842c05a2ce20a86cf3767f2a0b77311a5209657033751f7a92d5e37047bc99fd9a7a452bfdea3f5511f7a13581712fa9e10707e09dfd3d3c8964f2c3d05d00b8cdba65bdcf747a36aa6b8dc45dbef33aa9817a9fd7ec157b631383ab7f1492a8a7dbde8e6dd80fa1b149ae8a2d1e43ba873605aaaeb7e078274709d3185b58afcff3db99ffb9c956c70e2fc0b090594747f425d8a13fc446fa39ea55e08c7023026a98900146504760c658382fb3d73adf203df8b0b10dcf716011c1cc7a2616be140c27526a171ff6fe6728d93195b4886b03ab17d0131e3346746970311c7220b854ee9ccac48d57c47f981e83a792831930e0c7a3dabf11f78b6f862bba1b51eb14bc5fea3fe6ea80ced886a4b06a985f6d01b2f5c77620e0609a8c5b3c338892b179c9db3a020fbd93d87234b804b3f34ba6fa50454404540d5697d370f16ab8c3963c486134edfcc5516cb26b99dddf544b480fcacf266e74336b28a58b5ba51be26bac0dbd053f87d6f1af6dbd043f61095dfac5261e9357442eb444bf1692823bdd5641e4ef6ce7cc272c23e54f18dd484ca4df5db79d395b4d00c9301df2d4380b6261821973c4987d3348c37eecb054941ff9462aab1133e60a73371aa6f8f00ad26c84c50445f5eeb4d9aecd4c4bafcdd519bf9d508f261dbc666b842393c010f16b1c1d54736695db5ba622002d46ba221856e5eb2bfde5edbdf8bb4084085ae3c2ee96df505325b91a87d16763395858ea102127cf712844a5f08b9f9862af86ed9c93069bfeb90f8bc68c631f035c6502432e272d0cc54823a4fef2436bc808624e77619da1e4fc9d3bc96c581e21118f8b90049ef7cf4b5aefc5e281226cf07bbe45a5997faa9d42f895c0164e578b27a093e8b0ce938bac0837496a5ff49c50d71ebfc9d8b55e5e26c71d731f391b93ca48e130b82928e4f09fb4d6acbdc7da8ac844629619413a72b29892ab2520dec5959d1e44ad0fdcef9e5c7a1e2ca3c1ab8fd8353e512ac4fa6e1f50a6a7eb4a93cccfd85d514764a9a1a9e54a69972ce0cdcd113fb77604ad5faafb3400d438655608a954f206fe5d11bb902e8c0a6a781c3d245ab1bd289d18f83835ba68b2334ea8a01ccd4ccfd99bde8eb6a37078e00e8950a8a3bef82d5b8f4aaf33c3a420e2076f0c30d582ab7fe051bcce21f35a07aebf4b8f6cdba7bd2ed30a0fa3c8744502d024cd9e17ee26dd28b70861f87a0b5edd249c80b5f24f33e4331833679c9fa64025dae7d1cb8a4639e029928e365e27c023034b8f60fc83f064af39e0552c2c1660ac254fc8de8bb4af679a5081c70e339c6a95c1c2d0f4001ebc889600f93c78cebebfcd9618cd7bfd5733dee3051c730ff41bcde02e0066d718f1cadf3fe61c63f296eada8df05b2efde8cf3a00b39bff8a742cb3c27ff232ee48f4e47e07285f3f80a722a033e20797625652d81ba027873aca7c49c20f244e865094242d700b6524f4424410e8430726ed7838949d8fd1a7fb9d25e68e5b8bbd2f15319eaf6d64092a7c51ef4f5ba19edfc275566d05e78b7ca4abac270cdfe677d84533aba5384d6596e742372eeed1925e539555f6dde825e8558a178110f3721aa2dad0056841704192e89593ba06d0faa23ba4f93565ad5d2faa4a96452cd6bd5d8b34856b26f08d5240efb96d128858b6c9cdfa5c4960183537a9d6c1f726e086650602e8c48586a451176c0f3746dca592bc236c01b762562e1bd2897ed372ccb5eb069aa123052a995f5b7469c9e89f08bed1c151bcb2f8000f944990b3181c306bc5286f65cc68982caff9c8d3bd29e19e42a07af359ba32df07287628eceff75f4d37642a68d9c4e03bc80f31df6c596bc2352a1f636194b78f2e51baba4710f1efd635509c470b31f7f3b89efce242dd66e468b78a274d23502fda0436ca1faa600ce6e98e5f3cdab316495f93156a8e5d6261eb7d8e2077f197a004e107f3b22343adc1c1c6e340bbf188d481a3f28374c4616fccd0dd98c8565f27b2021247d5ceb7112c3e816719b73887de6b1dd6c4f246ceaebc264bfe5c3686cd5b86ed9b99743887f65eeeb237b972323e638aa2839eb7d4ba89852fa076d3e683e5b8970a3dcd42a98f0f456518b531998cd8ee5229011f891bfe0e9455bef514b6696bf7101a9b3dadb0772f99117b264fcdd65be93135c068b6e83890c9ccf9a1b05c016d100b273630373b075a2d086206536904455969409cf92d93ee71c689bc5e592005ad53bcc2b478fe8cbb6ee3107b6303e9121c393d1f40e79c1d030ba11de78b8a58be0954bbb2862cdc516b46329bd66333506f61293a67de83c18675f38257a32f8e76647e1884183d75a58383ca3e4be7a7543fcc78209e051f5260e87eefdec0bb20383a6736219c096f182f604b5cbdd8668d47ff2f11cd1117c20f1257dcb6f0f45439cfee95d963b17ccb83bf5c8d120ddfffa5a9d4140c0f69f3e4f4df49bd501d3f367071762128dfedfdb79bfdedf32655723bd513bdce12431543b7536078d46b201dae74bee2b1c6b558294fd2e683716f567997e02c52b69be070d687d7d5c6207f6d6f5fb6c41c5eb9cf673a4208bab50e7926e2f469a1f48c0a6ff3c99b1063f67b8e79855b7eb015d2fdae63510c442b16a8ecd9a938ebc9d051ab48e937e813a4c5ffa24d4298dae5458a9d117d31da721cd4b1b97d97c53f3cf731ab2a386c464bdd2d49ab1ea2ba05c4450693d0d33e5f4d679459b91bda92f2d84c3285171d8148fcb944513579050edf7067156b6decbbb4d025154ad9bbfab31aa3915fc327379f742570fdd56bd768e5ebd9d4cf9ccd15d4c0794580237152c8d0887a2a770790832d5553c0b0265518749e5d23738969fdaea50ee4da7e550ddd8df91a40309392058ae3f17479ab7631a2a7ea09fbac7d4a3aeddf1fadc199ba2be288b8fa6bced65452b52a5f0c07753cf365f055174dcf5a2cfc78f649886ed26b4013b2bbe2bccbf5ac938bf1d7306621ec9044e3f0538fcab010aa5edb81a655a63cf8bab004221cfe90ba613021c7b2e09e66afff4fb0a9e60c7bbbd44c858b087b7fda052282dc1fa97d932bd8bd27dd0dd49a8ca2cb234f0dc286fa7e915d8eac425ee2f85da22df7cb30f88c1a2134218dea1aa1d0dc8e380f629a23ee4248bf5802e76bfc797d292b5bdc540b6fe284adac93f77c142d63e13be7fe70f111454150999efec42c2878b11f41f0267f49ca6878021d33147cd05e9080aac0f92de3a2985ef901ccbd400c9c0c0c9fc62b58f3a3a45d679ae269cee4462037814eba78770109977bf12c8cc03e64fff795c8635eb2ca349c727a7c4b3de5ad6a871834054a86f629e96c1c9efaaaa87efde2c5fff7ff83490c0c5f5df84d1496aa73f5a9a5abb81983f72ecf4ad71fed87684b704b", 0xf20, 0xfffffffffffffffd) r2 = add_key$keyring(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$unlink(0x9, r1, r2) 12:01:57 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 505.794060] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x200002) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffff9c, 0x84, 0x75, &(0x7f0000000080)={0x0, 0x8}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000140)={r3, 0x1, 0x1}, 0x8) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000003000000000000000000000000000000000101000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) write$FUSE_INIT(r2, &(0x7f0000000200)={0x50, 0x0, 0x2, {0x7, 0x1b, 0x4e68f246, 0x2000, 0xb6, 0x0, 0x8, 0x80000001}}, 0x50) 12:01:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="09631040"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:57 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0xed5596ea]}}, 0x1c) [ 505.971790] XFS (loop3): Invalid superblock magic number [ 506.027381] binder_transaction: 6 callbacks suppressed [ 506.027391] binder: 24502:24509 got reply transaction with no transaction stack [ 506.046480] binder: 24510:24514 BC_ACQUIRE_DONE u0000000000000000 no match 12:01:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0f630c40"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 506.096383] binder_alloc: binder_alloc_mmap_handler: 24502 20001000-20004000 already mapped failed -16 12:01:58 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') connect(r0, &(0x7f00000000c0)=@nfc={0x27, 0x0, 0x2, 0x6}, 0x80) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 506.142317] binder: BINDER_SET_CONTEXT_MGR already set 12:01:58 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:58 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x21110]}}, 0x1c) [ 506.190827] binder: 24502:24509 ioctl 40046207 0 returned -16 [ 506.190859] binder_alloc: 24502: binder_alloc_buf, no vma [ 506.216200] binder: 24502:24509 got reply transaction with no transaction stack 12:01:58 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) set_tid_address(&(0x7f0000000040)) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 506.284819] binder: 24527:24536 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 506.324649] binder: send failed reply for transaction 1544 to 24502:24509 12:01:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) 12:01:58 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setrlimit(0x400000000000007, &(0x7f0000000000)) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f2f6e657400000000000000072f6578706972655f6e6f646573b14a8874745f63", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) chdir(&(0x7f0000000000)='./file0\x00') syz_extract_tcp_res(&(0x7f0000000040), 0x5, 0x3b) r3 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000240)={{{@in=@loopback, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@local}}, &(0x7f0000000340)=0xe8) getsockname(r2, &(0x7f0000000380)=@can={0x1d, 0x0}, &(0x7f0000000400)=0x80) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000440)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@dev}}, &(0x7f0000000540)=0xe8) recvmsg(r0, &(0x7f0000000700)={&(0x7f0000000580)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000600)=""/50, 0x32}], 0x1, &(0x7f0000000680)=""/104, 0x68, 0x80000000}, 0x40000020) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000740)={0x0, @dev, @dev}, &(0x7f0000000780)=0xc) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000001f00)={{{@in=@dev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast2}}, &(0x7f0000002000)=0xe8) getsockopt$inet6_mreq(r2, 0x29, 0x14, &(0x7f0000002080)={@local, 0x0}, &(0x7f00000020c0)=0x14) getsockname$packet(r2, &(0x7f0000002100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000002140)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000002180)={{{@in6=@ipv4, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@multicast2}}, &(0x7f0000002280)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000002300)={{{@in=@local, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@remote}}, &(0x7f0000002400)=0xe8) getsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000002440)={@multicast1, @remote, 0x0}, &(0x7f0000002480)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000024c0)={{{@in6, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@remote}}, &(0x7f00000025c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000002600)={'vcan0\x00', 0x0}) accept4$packet(r2, &(0x7f0000007240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000007280)=0x14, 0x80800) recvmsg(r1, &(0x7f0000007880)={&(0x7f00000072c0)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000007780)=[{&(0x7f0000007340)=""/172, 0xac}, {&(0x7f0000007400)=""/212, 0xd4}, {&(0x7f0000007500)=""/174, 0xae}, {&(0x7f00000075c0)=""/244, 0xf4}, {&(0x7f00000076c0)=""/178, 0xb2}], 0x5, &(0x7f0000007800)=""/89, 0x59, 0x7}, 0x120) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000078c0)={{{@in6=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}}}, &(0x7f00000079c0)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000007a00)={{{@in=@local, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in=@multicast1}}, &(0x7f0000007b00)=0xe8) sendmsg$TEAM_CMD_OPTIONS_GET(r2, &(0x7f0000008040)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000008000)={&(0x7f0000007b40)={0x4b8, r3, 0x400, 0x70bd2a, 0x2, {}, [{{0x8, 0x1, r4}, {0xf8, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r5}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}]}}, {{0x8, 0x1, r6}, {0x44, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r7}}}]}}, {{0x8, 0x1, r8}, {0x84, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r9}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r10}}}]}}, {{0x8, 0x1, r11}, {0x1a8, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r12}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r13}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x3c7e}}, {0x8, 0x6, r14}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x7fffffff}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r15}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r16}}}]}}, {{0x8, 0x1, r17}, {0x114, 0x2, [{0x54, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x24, 0x4, [{0x6, 0x3, 0xb4b}, {0x3, 0x100000001, 0x9, 0x2}, {0x7, 0x17, 0x430aaa7b, 0x100000001}, {0x9, 0x7, 0x790}]}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r18}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r19}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r20}}}]}}]}, 0x4b8}, 0x1, 0x0, 0x0, 0x1}, 0x10) [ 506.334671] binder: undelivered TRANSACTION_COMPLETE [ 506.388414] binder: 24527:24536 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:01:58 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0xe00000000000000]}}, 0x1c) 12:01:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='\x00c@@'], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 506.452749] binder: 24549:24553 got reply transaction with no transaction stack [ 506.472061] binder_alloc: binder_alloc_mmap_handler: 24549 20001000-20004000 already mapped failed -16 [ 506.491369] binder: BINDER_SET_CONTEXT_MGR already set [ 506.516043] binder: 24549:24553 ioctl 40046207 0 returned -16 [ 506.520254] XFS (loop3): Invalid superblock magic number [ 506.533452] binder_alloc: 24549: binder_alloc_buf, no vma [ 506.554780] binder: 24549:24563 got reply transaction with no transaction stack 12:01:58 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$unix(r1, 0x0, &(0x7f0000000040), 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 506.565801] binder: release 24549:24553 transaction 1549 out, still active [ 506.574844] binder: undelivered TRANSACTION_COMPLETE [ 506.599002] binder_alloc: 24549: binder_alloc_buf, no vma [ 506.600566] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f00000000c0)={0x0, 0x1ff, 0x401, 0xfffffffffffffffb, 0x3, 0xa4}) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair(0x5, 0x7, 0x379, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bind$rds(r2, &(0x7f0000000340)={0x2, 0x4e23, @rand_addr=0x6}, 0xfffffffffffffcdc) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0xffffffffffffffbe, 0x0, &(0x7f0000000380), 0x2a5, 0x0, &(0x7f00000002c0)}) setxattr$security_ima(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='security.ima\x00', &(0x7f0000000200)=@v1={0x2, "566038c9e51c361df30fb85b624230b6e7bc7723"}, 0x15, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="12674840e2187ef183519c9f2e0241385eb03442bef260ba06fd09497820e46cd17879d3da31bbe1cd9f47ae1da2736bd9b05a8449d3cf79565deaa8c607"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) socketpair(0x11, 0xa, 0x3, &(0x7f0000000280)) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x1010, r3, 0x0) [ 506.609074] binder: 24565:24567 ioctl c0306201 200001c0 returned -14 12:01:58 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0xf4010000]}}, 0x1c) 12:01:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='\vc\x00\x00'], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:58 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:58 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0xfffffffffffffcd5}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x2b3, 0x3ffffffffffd) [ 506.664969] binder: send failed reply for transaction 1549, target dead [ 506.810893] binder: 24580:24582 ioctl 40286608 200000c0 returned -22 [ 506.831490] binder: 24585:24592 ERROR: BC_REGISTER_LOOPER called without request [ 506.842478] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:01:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="07630440"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:58 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x10]}}, 0x1c) 12:01:58 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f00000000c0)=""/31, 0x1f}], 0x100000000000008f, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000000040)={0x3, r0, 0x1}) [ 506.949146] binder: 24580:24605 unknown command 1078486802 [ 506.979660] binder: 24580:24605 ioctl c0306201 200001c0 returned -22 [ 507.030131] XFS (loop3): Invalid superblock magic number [ 507.036798] binder: 24612:24616 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 507.075286] binder: 24580:24582 ioctl 40286608 200000c0 returned -22 [ 507.092136] binder: BINDER_SET_CONTEXT_MGR already set [ 507.121297] binder: 24580:24605 ioctl 40046207 0 returned -16 [ 507.143377] binder: 24580:24627 unknown command 1078486802 [ 507.166342] binder: 24580:24627 ioctl c0306201 200001c0 returned -22 12:01:59 executing program 4: syz_mount_image$vfat(&(0x7f0000001680)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x100000000000dfff, 0x1, &(0x7f0000000040)=[{&(0x7f00000016c0)="eb64c86d4f66732e66617400020441000500077008f8", 0x16}], 0x0, &(0x7f0000000140)=ANY=[]) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000240)='/dev/qat_adf_ctl\x00', 0x48000, 0x0) ioctl$KVM_KVMCLOCK_CTRL(r0, 0xaead) perf_event_open(&(0x7f0000000040)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f00000002c0)={{}, {0xa, 0x0, 0x0, @mcast2}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x5c) mknod(&(0x7f0000000280)='./file0/file0\x00', 0x0, 0x0) syz_mount_image$iso9660(&(0x7f0000000200)='iso9660\x00', &(0x7f00000005c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000840), 0x3040800, &(0x7f0000000900)) r1 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'bond_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000001c0)={&(0x7f0000000200), 0xc, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_deladdr={0x2c, 0x15, 0x101, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_LOCAL={0x14}]}, 0x2c}}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) utime(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000540)={0x0, 0x1}) umount2(&(0x7f0000000340)='./file0\x00', 0x1400) syz_open_dev$evdev(&(0x7f0000000580)='/dev/input/event#\x00', 0x5, 0x280) openat$mixer(0xffffffffffffff9c, &(0x7f0000000500)='/dev/mixer\x00', 0x0, 0x0) lstat(&(0x7f00000008c0)='./file0/file0\x00', &(0x7f0000000d80)) mknod(&(0x7f0000000180)='./file0\x00', 0x1000, 0x1) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000880)=ANY=[], &(0x7f0000000800)) 12:01:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='\nc\b@'], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:59 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0xf5ffffff]}}, 0x1c) 12:01:59 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000040)=0x0) fcntl$setown(r1, 0x8, r3) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) flistxattr(r2, &(0x7f00000000c0)=""/101, 0x65) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:01:59 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667303", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:01:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0xfffffffffffffff8) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) r2 = accept4$bt_l2cap(0xffffffffffffff9c, &(0x7f0000000200), &(0x7f0000000240)=0xe, 0x80800) sendto(r2, &(0x7f0000000380)="7e9bb1f7f9f215bafa341a4ade711f70b907a4096483209ed72ee3243707baa7394a87e9046893b69fa878a874f5a7cf222e637c722ba2a68cff4f200f1aaec004aa2c6821c8973c0bc3561efdb080734320bdbba86b7615eb4eb0505266e1f0c54ab1929a8591bc767892f4f3c627b638bd3de62940e483fb8f9079da1f79fedb2e2a2a79793ae318941ee4e3820ae7", 0x90, 0x40000, &(0x7f0000000280)=@llc={0x1a, 0x18, 0x3, 0x9, 0x2, 0xc60, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0x80) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/ignore_tunneled\x00', 0x2, 0x0) accept$packet(0xffffffffffffff9c, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) bind$bt_hci(r3, &(0x7f0000000180)={0x1f, r4, 0x2}, 0xc) [ 507.437546] binder: 24643:24645 got reply transaction with no transaction stack [ 507.456172] binder: BC_ATTEMPT_ACQUIRE not supported [ 507.476198] binder_alloc: binder_alloc_mmap_handler: 24643 20001000-20004000 already mapped failed -16 12:01:59 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x42bb0500]}}, 0x1c) [ 507.484673] binder: 24640:24649 ioctl c0306201 200001c0 returned -22 12:01:59 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') mkdir(&(0x7f0000000040)='./file0\x00', 0x4) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0xa4, r1, 0x200, 0x70bd26, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@broadcast}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x2f}]}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xaf}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x8, 0x4}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x2f}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4004010}, 0x40) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:01:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0e630c40"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 507.521488] binder: BINDER_SET_CONTEXT_MGR already set [ 507.537019] binder: 24643:24663 got reply transaction with no transaction stack [ 507.538600] QAT: Invalid ioctl [ 507.604287] binder: 24643:24645 ioctl 40046207 0 returned -16 12:01:59 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="786673f6", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 507.682562] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 507.709154] binder: 24676:24679 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 12:01:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x40002, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e23, @multicast1}], 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) [ 507.775595] QAT: Invalid ioctl 12:01:59 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0xffffffffffffffff]}}, 0x1c) 12:01:59 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x3, 0x0) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r1, 0x111, 0x1, 0x4, 0x4) sendmsg$IPVS_CMD_DEL_DEST(r1, &(0x7f0000000380)={&(0x7f0000000200), 0xc, &(0x7f0000000340)={&(0x7f0000000280)=ANY=[]}}, 0x90) recvmsg(r1, &(0x7f00000001c0)={&(0x7f0000000000)=@generic, 0x80, &(0x7f00000000c0), 0x0, &(0x7f00000003c0)=""/190, 0xbe}, 0x0) write(r1, &(0x7f0000000140)="240000005a001f00ff03f4f9002304000a04f51108000100020100020800038001000000", 0x24) 12:01:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='\fc\x00\x00'], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:01:59 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) truncate(&(0x7f0000000040)='./file0\x00', 0xa8b) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:01:59 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x240]}}, 0x1c) [ 507.947104] binder: 24696:24700 got reply transaction with no transaction stack [ 508.011597] binder_alloc: binder_alloc_mmap_handler: 24696 20001000-20004000 already mapped failed -16 [ 508.050408] binder: BINDER_SET_CONTEXT_MGR already set 12:02:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="08631040"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:02:00 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x1100000000000000]}}, 0x1c) [ 508.067611] binder: 24696:24700 ioctl 40046207 0 returned -16 [ 508.085020] binder: 24696:24704 got reply transaction with no transaction stack [ 508.085059] binder_alloc: 24696: binder_alloc_buf, no vma [ 508.095053] binder: release 24696:24700 transaction 1559 out, still active [ 508.106021] binder: undelivered TRANSACTION_COMPLETE 12:02:00 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f00000000c0)={0x0, 0xa3, "30b08ceeecbb2786275b9cec2d97d472802bd4460f3eeb4657eb3e57b0f55f87fc32e758dfb1f44f788edc7dec472ba47a131832685112cdf59e78cc5ac4002f4c90956d50d5bb3820662f25a954500b5792d12cc131b875b808d8c75f4e2a94d39539c750b1b0442b893611e3a7f3af8bac6d8c46316ef7c9484d984c2b95d95eae75dfc0dde2144c0dec4b9621ae64963a145b03e536ac4680ff6ed2661e780d625c"}, &(0x7f0000000180)=0xab) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r1, 0x3}, &(0x7f0000000240)=0x8) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000040)={0x2}, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:02:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000100)=@newlink={0x20, 0x64, 0xe3b}, 0x20}}, 0x0) fchdir(r1) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r2}], 0x1, 0x0) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x0, 0x0) ioctl$SIOCGIFHWADDR(r3, 0x8927, &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) fchdir(r0) 12:02:00 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 508.175158] binder: send failed reply for transaction 1559, target dead [ 508.191867] binder: 24723:24724 BC_INCREFS_DONE u0000000000000000 no match [ 508.267529] Unknown ioctl 35111 12:02:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='HcH@'], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:02:00 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000340)='io.weight\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000100)='io.stat\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x10) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000140)) [ 508.295116] binder: 24728:24733 got reply transaction with no transaction stack [ 508.297389] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 508.369575] binder: BINDER_SET_CONTEXT_MGR already set [ 508.395050] binder: 24728:24747 ioctl 40046207 0 returned -16 [ 508.408903] XFS (loop3): Invalid superblock magic number 12:02:00 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) ioctl$sock_bt(r0, 0x8906, &(0x7f0000000100)) 12:02:00 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x300]}}, 0x1c) 12:02:00 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) getsockname$unix(r1, &(0x7f0000000140)=@abs, &(0x7f0000000040)=0x6e) ioctl$sock_bt_hci(r0, 0x400448cc, &(0x7f00000000c0)="4310c521f02750df9cdef38ad0fc9a49239bdc33325a1fee0647f9d8b18c15b0fe83616a22c24f6a9f407d3bef83e782b99c0c259265c5734701ef5c09090d62767bdc1903a9cf33178204ea563cc737eb7bbf21eecc95461766099782effd62") [ 508.437659] Unknown ioctl 35111 [ 508.455111] binder: 24749:24759 unknown command 1078485832 [ 508.461094] binder: 24749:24759 ioctl c0306201 200001c0 returned -22 [ 508.468132] binder_alloc: 24728: binder_alloc_buf, no vma [ 508.508754] binder: 24728:24733 got reply transaction with no transaction stack [ 508.535573] binder_transaction: 20 callbacks suppressed [ 508.535592] binder: 24728:24747 transaction failed 29189/-3, size 0-0 line 2973 12:02:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="01634040"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:02:00 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="786673d0", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:02:00 executing program 4: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = accept4$inet(0xffffffffffffff9c, &(0x7f0000000000)={0x2, 0x0, @rand_addr}, &(0x7f00000000c0)=0x10, 0x800) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e23, 0x3, @loopback, 0x1}}, 0x6, 0x3, 0x6, 0x6, 0xa2}, &(0x7f00000001c0)=0x98) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000280)={r2, 0xf, "dd6209c9411888ffd1aab0564b1e09"}, &(0x7f00000002c0)=0x17) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000040)="637075262222000ac0f92a60006c4a947864c820f4b3ca0c907c1f66f0d29b61024b2828b182b270bbf3ddba72aabf5965d7a337c0ae24b12aeb00b5787f562d57eb9cf5e52064995d4f1399754abdef6583c2177e9e5cac1f93") r3 = syz_open_dev$dmmidi(&(0x7f0000000300)='/dev/dmmidi#\x00', 0x5, 0x10080) sendmsg$rds(r3, &(0x7f0000003980)={&(0x7f0000000340)={0x2, 0x4e21, @multicast1}, 0x10, &(0x7f00000025c0)=[{&(0x7f0000000380)=""/50, 0x32}, {&(0x7f00000003c0)=""/220, 0xdc}, {&(0x7f00000004c0)=""/200, 0xc8}, {&(0x7f00000005c0)=""/4096, 0x1000}, {&(0x7f00000015c0)=""/4096, 0x1000}], 0x5, &(0x7f0000003800)=[@rdma_dest={0x18, 0x114, 0x2, {0x1, 0x356}}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000002640)=""/4096, 0x1000}, &(0x7f0000003640), 0x20}}, @fadd={0x58, 0x114, 0x6, {{0x101, 0x3f}, &(0x7f0000003680)=0xaf16, &(0x7f00000036c0)=0x401, 0x7e3f79b3, 0x52, 0x3, 0xffffffff, 0x2, 0x100}}, @mask_fadd={0x58, 0x114, 0x8, {{0x23, 0x7e95}, &(0x7f0000003700)=0x1, &(0x7f0000003740)=0x7, 0x5c, 0x3f, 0xffff, 0x1, 0xe, 0x3000000000}}, @mask_fadd={0x58, 0x114, 0x8, {{0x6, 0xde}, &(0x7f0000003780)=0x3, &(0x7f00000037c0)=0xfffffffffffff800, 0x9b, 0x7, 0xaaa, 0x8, 0x10, 0x5d342233}}], 0x150, 0x4000004}, 0x20000800) [ 508.566663] binder: release 24728:24733 transaction 1564 out, still active [ 508.585497] binder: 24728:24733 transaction failed 29201/-71, size 0-0 line 2741 [ 508.596684] binder: undelivered TRANSACTION_COMPLETE [ 508.604818] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:02:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x8, 0x400) bind$unix(r2, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) r3 = semget(0x3, 0x2, 0x42) semctl$GETNCNT(r3, 0x4, 0xe, &(0x7f0000000200)=""/240) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) [ 508.635047] binder_release_work: 18 callbacks suppressed [ 508.635055] binder: undelivered TRANSACTION_ERROR: 29201 [ 508.695932] binder: send failed reply for transaction 1564, target dead 12:02:00 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x9]}}, 0x1c) 12:02:00 executing program 5: pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x80800) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r0, 0x8008ae9d, &(0x7f0000000240)=""/198) r1 = add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$setperm(0x5, r1, 0x10) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f00000000c0)=""/121) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000140), 0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r2, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 508.738454] binder: 24778:24785 transaction failed 29201/-71, size 0-0 line 2741 [ 508.754702] binder: undelivered TRANSACTION_ERROR: 29201 [ 508.760261] binder: undelivered TRANSACTION_ERROR: 29189 [ 508.768747] binder: 24778:24785 ioctl c0306201 200001c0 returned -14 [ 508.801353] binder: 24786:24790 transaction failed 29201/-71, size 0-0 line 2741 12:02:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="11634840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:02:00 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000d08ff7)='/dev/sg#\x00', 0x0, 0x81) statfs(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/8) close(r0) [ 508.863032] binder_alloc: binder_alloc_mmap_handler: 24786 20001000-20004000 already mapped failed -16 [ 508.902283] binder: BINDER_SET_CONTEXT_MGR already set [ 508.931938] binder: 24786:24790 ioctl 40046207 0 returned -16 [ 508.955302] binder_alloc: 24786: binder_alloc_buf, no vma [ 508.966931] binder: 24786:24811 transaction failed 29201/-71, size 0-0 line 2741 [ 508.970292] binder: 24806:24809 transaction failed 29189/-3, size 0-0 line 2973 12:02:00 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x200000000000000]}}, 0x1c) 12:02:00 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs^', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 508.992819] binder_alloc: 24786: binder_alloc_buf, no vma [ 508.994048] binder: 24806:24809 ioctl c0306201 200001c0 returned -14 [ 509.017720] binder: release 24786:24790 transaction 1570 out, still active [ 509.024886] binder: 24786:24797 transaction failed 29189/-3, size 0-0 line 2973 [ 509.025501] binder_alloc: 24786: binder_alloc_buf, no vma 12:02:01 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 509.045471] binder: undelivered TRANSACTION_COMPLETE [ 509.064790] binder: 24806:24809 transaction failed 29189/-3, size 0-0 line 2973 12:02:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000017c0)='/dev/binder#\x00', 0x0, 0x4) recvmmsg(0xffffffffffffff9c, &(0x7f00000015c0)=[{{&(0x7f0000000140)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f0000000280)=[{&(0x7f00000001c0)=""/122, 0x7a}, {&(0x7f0000000240)=""/38, 0x26}], 0x2, &(0x7f00000002c0)=""/32, 0x20, 0x3}, 0x3f}, {{&(0x7f0000000380)=@rc, 0x80, &(0x7f0000000780)=[{&(0x7f0000000400)=""/32, 0x20}, {&(0x7f0000000480)=""/252, 0xfc}, {&(0x7f0000000580)=""/41, 0x29}, {&(0x7f00000005c0)=""/251, 0xfb}, {&(0x7f00000006c0)=""/5, 0x5}, {&(0x7f0000000700)=""/90, 0x5a}], 0x6, &(0x7f0000000800)=""/61, 0x3d}, 0x9}, {{&(0x7f0000000840)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000000a80)=[{&(0x7f00000008c0)=""/56, 0x38}, {&(0x7f0000000900)=""/87, 0x57}, {&(0x7f0000000980)=""/183, 0xb7}, {&(0x7f0000000a40)=""/19, 0x13}], 0x4, 0x0, 0x0, 0x7}, 0x800000000000000}, {{&(0x7f0000000ac0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000fc0)=[{&(0x7f0000000b40)=""/111, 0x6f}, {&(0x7f0000000bc0)=""/163, 0xa3}, {&(0x7f0000000c80)=""/188, 0xbc}, {&(0x7f0000000d40)=""/69, 0x45}, {&(0x7f0000000dc0)=""/209, 0xd1}, {&(0x7f0000000ec0)=""/205, 0xcd}], 0x6, &(0x7f0000001040)=""/74, 0x4a, 0xb4e}, 0x7fffffff}, {{&(0x7f00000010c0)=@in6={0xa, 0x0, 0x0, @mcast2}, 0x80, &(0x7f0000001200)=[{&(0x7f0000001140)=""/145, 0x91}], 0x1, &(0x7f0000001240)=""/201, 0xc9, 0x81}, 0x400}, {{0x0, 0x0, &(0x7f00000014c0)=[{&(0x7f0000001340)=""/206, 0xce}, {&(0x7f0000001440)=""/124, 0x7c}], 0x2, &(0x7f0000001500)=""/170, 0xaa, 0x7fffffff}, 0x6}], 0x6, 0x1, &(0x7f0000001740)={0x0, 0x1c9c380}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001780)) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000001800)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r2}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000001840)=ANY=[@ANYBLOB="006340400002000000000000000000000000000005213345b9000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0xffffffffffffffd7, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000040)="bce854e9"}) [ 509.111313] binder: undelivered TRANSACTION_ERROR: 29201 [ 509.116927] binder: undelivered TRANSACTION_ERROR: 29189 [ 509.131101] binder: 24806:24809 ioctl c0306201 200001c0 returned -14 12:02:01 executing program 4: socketpair(0x1e, 0x5, 0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$setmm(0x23, 0x1, &(0x7f0000c00000/0x400000)=nil) [ 509.164908] binder: undelivered TRANSACTION_ERROR: 29201 [ 509.170436] binder: send failed reply for transaction 1570, target dead [ 509.202495] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:02:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='\rc\x00\x00'], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:02:01 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0xea9655ed00000000]}}, 0x1c) 12:02:01 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667380", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 509.324882] binder: 24832:24842 ioctl c0306201 20000440 returned -14 12:02:01 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in=@remote, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f0000000380)=0xe8) fsetxattr$security_capability(r0, &(0x7f0000000240)='security.capability\x00', &(0x7f00000003c0)=@v3={0x3000000, [{0x3ff, 0x9}, {0x5bb547a9, 0x2}], r2}, 0x18, 0x1) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x1009}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000140)={0x16, 0x98, 0xfa00, {&(0x7f0000000040), 0x2, r3, 0x3c, 0x0, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1b}}}}, 0xa0) 12:02:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="02630440"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:02:01 executing program 4: socketpair(0x1e, 0x5, 0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$setmm(0x23, 0x1, &(0x7f0000c00000/0x400000)=nil) [ 509.395014] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:02:01 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x11]}}, 0x1c) 12:02:01 executing program 4: socketpair(0x1e, 0x5, 0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$setmm(0x23, 0x1, &(0x7f0000c00000/0x400000)=nil) [ 509.558517] binder: BC_ACQUIRE_RESULT not supported [ 509.575999] binder: 24858:24864 ioctl c0306201 200001c0 returned -22 12:02:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="04630440"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:02:01 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400202) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:02:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x8c8, 0x800) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='eth1\x00', r2}, 0x10) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) 12:02:02 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x4000000]}}, 0x1c) 12:02:02 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)="78667310", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:02:02 executing program 4: socketpair(0x1e, 0x5, 0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$setmm(0x23, 0x1, &(0x7f0000c00000/0x400000)=nil) 12:02:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) 12:02:02 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') keyctl$session_to_parent(0x12) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 510.077513] binder: BINDER_SET_CONTEXT_MGR already set [ 510.082828] binder: 24832:24891 ioctl 40046207 0 returned -16 [ 510.089742] binder: 24832:24890 ioctl c0306201 20000440 returned -14 [ 510.158550] binder: 24892:24901 BC_FREE_BUFFER u0000000000000000 no match [ 510.180486] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:02:02 executing program 4: socketpair(0x1e, 0x5, 0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) prctl$setmm(0x23, 0x1, &(0x7f0000c00000/0x400000)=nil) 12:02:02 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0xff000000]}}, 0x1c) [ 510.237264] binder: 24898:24905 transaction failed 29201/-71, size 0-0 line 2741 12:02:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="10630840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 510.322315] binder: BINDER_SET_CONTEXT_MGR already set 12:02:02 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x503002, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000180)={r1, @in6={{0xa, 0x4e24, 0xffffffffffff3731, @mcast2, 0x8}}, 0x174, 0x10000, 0x7, 0x3cdd8000000, 0x35}, &(0x7f0000000240)=0x98) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r2, &(0x7f00000017c0), 0x1fe, 0x400000000000) 12:02:02 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) [ 510.344256] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 510.350179] binder: 24898:24922 transaction failed 29201/-71, size 0-0 line 2741 [ 510.360672] binder: 24923:24924 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 510.369862] binder: 24898:24905 ioctl 40046207 0 returned -16 [ 510.386270] binder: release 24898:24905 transaction 1579 out, still active 12:02:02 executing program 4: socketpair(0x1e, 0x5, 0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) prctl$setmm(0x23, 0x1, &(0x7f0000c00000/0x400000)=nil) [ 510.393303] binder: undelivered TRANSACTION_COMPLETE [ 510.398942] binder_alloc: 24898: binder_alloc_buf, no vma [ 510.454838] binder: undelivered TRANSACTION_ERROR: 29201 [ 510.460350] binder: send failed reply for transaction 1579, target dead 12:02:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x200, 0x0) ioctl$EVIOCGBITSW(r2, 0x80404525, &(0x7f0000000080)=""/92) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) 12:02:02 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0xea9655ed]}}, 0x1c) 12:02:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12254840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 510.500813] binder: undelivered TRANSACTION_ERROR: 29189 [ 510.555364] binder: undelivered TRANSACTION_ERROR: 29201 12:02:02 executing program 4: socketpair(0x1e, 0x5, 0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) prctl$setmm(0x23, 0x1, &(0x7f0000c00000/0x400000)=nil) [ 510.595721] binder: 24948:24949 unknown command 1078469906 [ 510.629344] QAT: Invalid ioctl [ 510.633708] binder: 24948:24949 ioctl c0306201 200001c0 returned -22 12:02:02 executing program 5: r0 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x7, 0x4200) recvmmsg(r0, &(0x7f0000005f80), 0x0, 0x2000000000000, &(0x7f0000000080)={0x77359400}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000180)='trusted.overlay.nlink\x00', &(0x7f00000001c0)={'U+', 0x4}, 0x28, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) accept$unix(r0, &(0x7f00000000c0), &(0x7f0000000140)=0x6e) 12:02:02 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x91ffffff]}}, 0x1c) [ 510.649344] binder_alloc: binder_alloc_mmap_handler: 24950 20001000-20004000 already mapped failed -16 [ 510.681261] binder: 24948:24949 unknown command 1078469906 12:02:02 executing program 4: socketpair(0x1e, 0x5, 0x0, &(0x7f0000000000)={0x0, 0x0}) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$setmm(0x23, 0x1, &(0x7f0000c00000/0x400000)=nil) [ 510.693616] binder: 24948:24949 ioctl c0306201 200001c0 returned -22 [ 510.701754] QAT: Invalid ioctl [ 510.713905] XFS (loop3): Invalid superblock magic number [ 510.731426] binder: BINDER_SET_CONTEXT_MGR already set 12:02:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="120a4840"], 0x1, 0x2000000, &(0x7f0000000480)="bc"}) [ 510.764354] binder: 24950:24951 ioctl 40046207 0 returned -16 [ 510.764408] binder_alloc: 24950: binder_alloc_buf, no vma [ 510.798481] binder: release 24950:24951 transaction 1584 out, still active 12:02:02 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$IP_VS_SO_GET_SERVICE(r2, 0x0, 0x483, &(0x7f00000000c0), &(0x7f0000000140)=0x68) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r1, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000300)={&(0x7f0000000580)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="020dca0b5c00fcdbdf2511400000080004000800000008060000000000002400020008a4cbcd0d640005007fffffff080002004e220000080002004e24000008000700000000000c00022008000b000a060000080006000c4fffff0800060000000000f887bfe8751be054279e55f190aee709cb1cb8ebb99ad73598cfbdd895938d6fd5124a8bb3b3b680ad6997db32832efa1dafb7352a35aa72cfb29c843444f79eae34b51f679a802207a69f939aa7a3aea7393d6c6bea97876e19894dcda58acc22ba6971be42511a1da1c09e83dbf2fd372ca5cb13deb11b7f90fe95d4cae2f6524470bcc1765ba56bb746c9c3cf9ca443fd83f3798606fa325adc9297b89b6c4469951876a647339d4a247bf370a635d5ec52ea6ed1d3a312bdffc91cbe96fc11e5a66ad1d1cb88a9373fa41e2bf5bee4ca58202a5ffb93d9b7192eaff8db2347cc560000002419735a6175a9cc7ff47ea0bd51d35f564d5f5cac5c9189513cc2bbe26e4693d3598a2c0ad7288cd5713b1696bf73c625651b06e760c360051c56bb64120715d9d31b9fcf36a6a4d349f798e673ee0c758604d02dd8e6e7aaa4528adcbaba9e28480f4ebb11b02b16c62213ee03b3ebb9d9d7761cdb"], 0x64}, 0x1, 0x0, 0x0, 0x4}, 0x40080) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) ioctl$VHOST_SET_VRING_CALL(r1, 0x4008af21, &(0x7f0000000280)={0x1, r1}) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000180)={0x539, 0x1, 0x8000}, 0x4) [ 510.810340] binder: undelivered TRANSACTION_COMPLETE 12:02:02 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x20000]}}, 0x1c) [ 510.848785] binder: 24979:24981 unknown command 1078462994 [ 510.868084] binder: 24979:24981 ioctl c0306201 200001c0 returned -22 [ 510.879319] binder: 24979:24981 unknown command 1078462994 [ 510.895042] binder: undelivered TRANSACTION_ERROR: 29201 12:02:02 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)={[{@filestreams='filestreams'}]}) 12:02:02 executing program 4: socketpair(0x1e, 0x5, 0x0, &(0x7f0000000000)={0x0, 0x0}) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$setmm(0x23, 0x1, &(0x7f0000c00000/0x400000)=nil) 12:02:02 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) poll(&(0x7f0000000000)=[{r0, 0xffffffffffffffff}], 0x0, 0x0) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) syz_open_dev$rtc(&(0x7f00000000c0)='/dev/rtc#\x00', 0x3, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="12634814b47902e1aa42d1cc453f71f6e4b13162a71617309b2e26ed5f9a30ff43f8a74bea776c9e871d9013981010f9b14f15e197c205571b783847146c201bd96eaba35b96efa202a5a7b1a82749c305147d2b5c84cb82ffdcd606bf3e83a1bb233b3677ee587c2572590b3cc25717e50d48d8f1d6bb30039c0c6f32a2c4"], 0x4, 0x0, &(0x7f0000000480)="bce854e9"}) [ 510.925782] binder: send failed reply for transaction 1584, target dead [ 510.941442] binder: 24979:24981 ioctl c0306201 200001c0 returned -22 [ 510.965007] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 12:02:02 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0xc, &(0x7f0000000000)="890528e4", 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x5]}}, 0x1c) [ 510.978943] WARNING: CPU: 0 PID: 9 at include/net/sock.h:1539 tcp_cleanup_ulp+0x1ad/0x200 [ 510.987615] Kernel panic - not syncing: panic_on_warn set ... [ 510.993526] CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.19.0-rc8-next-20181016+ #95 [ 511.001507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 511.010890] Call Trace: [ 511.013495] dump_stack+0x244/0x39d [ 511.017140] ? dump_stack_print_info.cold.1+0x20/0x20 [ 511.022360] panic+0x2ad/0x55c [ 511.025574] ? add_taint.cold.5+0x16/0x16 12:02:03 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{&(0x7f0000001c80)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000002e00)=[{&(0x7f0000001d00)=""/31, 0x1f}], 0x1, &(0x7f0000002e40)=""/16, 0x10}}], 0x1, 0x0, &(0x7f0000000080)={0x77359400}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_inet6_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000040)={@remote, 0x10, r0}) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 511.029739] ? __warn.cold.8+0x5/0x45 [ 511.033577] ? __warn+0xe8/0x1d0 [ 511.036967] ? tcp_cleanup_ulp+0x1ad/0x200 [ 511.041226] __warn.cold.8+0x20/0x45 [ 511.044969] ? rcu_softirq_qs+0x20/0x20 [ 511.045039] kobject: 'loop2' (000000007674cfb7): kobject_uevent_env [ 511.048968] ? tcp_cleanup_ulp+0x1ad/0x200 [ 511.059612] report_bug+0x254/0x2d0 [ 511.063340] do_error_trap+0x11b/0x200 [ 511.067274] do_invalid_op+0x36/0x40 [ 511.071000] ? tcp_cleanup_ulp+0x1ad/0x200 [ 511.071635] kobject: 'loop2' (000000007674cfb7): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 511.075248] invalid_op+0x14/0x20 [ 511.075263] RIP: 0010:tcp_cleanup_ulp+0x1ad/0x200 [ 511.075277] Code: 83 c0 03 38 d0 7c 04 84 d2 75 61 44 8b 25 cb 4e df 02 31 ff 44 89 e6 e8 51 3d ed fa 45 85 e4 0f 84 91 fe ff ff e8 33 3c ed fa <0f> 0b e9 85 fe ff ff 4c 89 ef e8 34 84 30 fb e9 9f fe ff ff 4c 89 [ 511.075286] RSP: 0018:ffff8801d9ad66b0 EFLAGS: 00010206 [ 511.075298] RAX: ffff8801d9abe240 RBX: ffff880181a92f80 RCX: ffffffff8690e6ff [ 511.075306] RDX: 0000000000000100 RSI: ffffffff8690e70d RDI: 0000000000000005 [ 511.075314] RBP: ffff8801d9ad66d0 R08: ffff8801d9abe240 R09: 0000000000000000 [ 511.075322] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 [ 511.075330] R13: 0000000000000000 R14: 0000000000000003 R15: ffff8801d9ad67f0 [ 511.075353] ? tcp_cleanup_ulp+0x19f/0x200 [ 511.075366] ? tcp_cleanup_ulp+0x1ad/0x200 [ 511.075392] tcp_v4_destroy_sock+0x15c/0x980 [ 511.075408] ? debug_object_init_on_stack+0x20/0x20 [ 511.075428] ? ip_queue_xmit+0x70/0x70 [ 511.175441] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 511.180991] ? hrtimer_try_to_cancel+0xb8/0x6f0 [ 511.185665] ? tcp_set_state+0x1d0/0x9c0 [ 511.189739] ? del_timer+0xf9/0x150 [ 511.193370] ? detach_if_pending+0x6b0/0x6b0 [ 511.197801] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 511.203345] ? check_preemption_disabled+0x48/0x280 [ 511.208387] tcp_v6_destroy_sock+0x15/0x20 [ 511.212663] inet_csk_destroy_sock+0x19f/0x440 [ 511.217258] tcp_done+0x272/0x310 [ 511.220738] tcp_v6_syn_recv_sock+0x1f21/0x25f0 [ 511.225452] ? inet6_sk_rx_dst_set+0xb30/0xb30 [ 511.230049] ? ip6_dst_lookup_tail+0xba3/0x1d60 [ 511.234734] ? __local_bh_enable_ip+0x160/0x260 [ 511.239412] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 511.244964] ? ip6_dst_lookup_tail+0x3c8/0x1d60 [ 511.249673] ? __lock_is_held+0xb5/0x140 [ 511.253756] ? rcu_read_lock_sched_held+0x14f/0x180 [ 511.258851] tcp_get_cookie_sock+0x10e/0x580 [ 511.263276] ? cookie_ecn_ok+0x140/0x140 [ 511.267344] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 511.272939] ? xfrm_lookup_route+0x74/0x1f0 [ 511.277287] ? ip6_dst_lookup_flow+0x1ce/0x270 [ 511.281901] ? ip6_dst_lookup+0x60/0x60 [ 511.285886] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 511.291428] ? tcp_select_initial_window+0x1e6/0x400 [ 511.296541] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 511.302093] cookie_v6_check+0x1830/0x27d0 [ 511.306350] ? cookie_v6_init_sequence+0xe0/0xe0 [ 511.311114] ? find_held_lock+0x36/0x1c0 [ 511.315258] ? sk_filter_trim_cap+0x476/0xa60 [ 511.319789] ? lock_downgrade+0x900/0x900 [ 511.323989] ? check_preemption_disabled+0x48/0x280 [ 511.329022] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 511.333968] ? kasan_check_read+0x11/0x20 [ 511.338130] ? rcu_softirq_qs+0x20/0x20 [ 511.342130] ? sk_filter_trim_cap+0xfb/0xa60 [ 511.346562] ? tcp_v6_inbound_md5_hash+0x1b7/0x410 [ 511.351505] tcp_v6_do_rcv+0x10ea/0x13c0 [ 511.355572] ? tcp_v6_do_rcv+0x10ea/0x13c0 [ 511.359821] tcp_v6_rcv+0x34e0/0x3ab0 [ 511.363630] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 511.368718] ? tcp_v6_reqsk_send_ack+0x370/0x370 [ 511.373498] ? __lock_is_held+0xb5/0x140 [ 511.377582] ip6_input_finish+0x3fc/0x1aa0 [ 511.381855] ? ip6_rcv_core.isra.16+0x1e10/0x1e10 [ 511.386732] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 511.391772] ? nf_hook_slow+0x11e/0x1c0 [ 511.395779] ip6_input+0xe4/0x600 [ 511.399246] ? ip6_input_finish+0x1aa0/0x1aa0 [ 511.403751] ? ip6_rcv_core.isra.16+0x1e10/0x1e10 [ 511.408603] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 511.413540] ? kasan_check_read+0x11/0x20 [ 511.417700] ? rcu_softirq_qs+0x20/0x20 [ 511.421711] ip6_rcv_finish+0x17a/0x330 [ 511.425693] ipv6_rcv+0x110/0x630 [ 511.429152] ? __lock_acquire+0x62f/0x4c20 [ 511.433392] ? ip6_input+0x600/0x600 [ 511.437114] ? ip6_rcv_finish_core.isra.13+0x720/0x720 [ 511.442410] ? lock_acquire+0x1ed/0x520 [ 511.446392] ? process_backlog+0x1dd/0x7a0 [ 511.450675] __netif_receive_skb_one_core+0x14d/0x200 [ 511.455874] ? __netif_receive_skb_core+0x3b20/0x3b20 [ 511.461097] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 511.466382] ? rcu_softirq_qs+0x20/0x20 [ 511.470615] ? trace_hardirqs_off_caller+0x300/0x300 [ 511.475760] __netif_receive_skb+0x27/0x1e0 [ 511.480090] process_backlog+0x24e/0x7a0 [ 511.484174] net_rx_action+0x7fa/0x19b0 [ 511.488174] ? napi_complete_done+0x7a0/0x7a0 [ 511.492681] ? find_held_lock+0x36/0x1c0 [ 511.496770] ? __run_timers+0xa1b/0xc60 [ 511.500755] ? _raw_spin_unlock_irq+0x27/0x80 [ 511.505262] ? _raw_spin_unlock_irq+0x27/0x80 [ 511.509776] ? lockdep_hardirqs_on+0x296/0x5b0 [ 511.514366] ? trace_hardirqs_on+0xbd/0x310 [ 511.518692] ? kasan_check_read+0x11/0x20 [ 511.522849] ? __run_timers+0xa1b/0xc60 [ 511.526854] ? _raw_spin_unlock_irq+0x60/0x80 [ 511.531378] ? __run_timers+0xa45/0xc60 [ 511.535374] ? timer_fixup_init+0x70/0x70 [ 511.539584] ? compat_start_thread+0x80/0x80 [ 511.544030] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 511.549596] ? _raw_spin_unlock_irq+0x60/0x80 [ 511.554111] ? finish_task_switch+0x1f4/0x920 [ 511.558622] ? finish_task_switch+0x1b4/0x920 [ 511.563122] ? __switch_to_asm+0x34/0x70 [ 511.567196] ? preempt_notifier_register+0x200/0x200 [ 511.572306] ? __switch_to_asm+0x34/0x70 [ 511.576646] ? __switch_to_asm+0x34/0x70 [ 511.580722] ? __switch_to_asm+0x40/0x70 [ 511.584786] ? __switch_to_asm+0x34/0x70 [ 511.588849] ? __switch_to_asm+0x40/0x70 [ 511.592911] ? __switch_to_asm+0x34/0x70 [ 511.596999] ? __switch_to_asm+0x40/0x70 [ 511.601062] ? __switch_to_asm+0x34/0x70 [ 511.605147] ? __switch_to_asm+0x40/0x70 [ 511.609240] ? pvclock_read_flags+0x160/0x160 [ 511.613743] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 511.619288] ? check_preemption_disabled+0x48/0x280 [ 511.624332] ? rcu_lockdep_current_cpu_online+0x1a4/0x210 [ 511.629876] ? rcu_pm_notify+0xc0/0xc0 [ 511.633803] __do_softirq+0x308/0xb7e [ 511.637631] ? trace_hardirqs_on_caller+0xc0/0x310 [ 511.642570] ? __irqentry_text_end+0x1f9688/0x1f9688 [ 511.647680] ? trace_hardirqs_on+0x310/0x310 [ 511.652089] ? retint_kernel+0x2d/0x2d [ 511.656005] ? schedule+0x108/0x460 [ 511.659651] ? trace_hardirqs_off+0xb8/0x310 [ 511.664077] ? smpboot_thread_fn+0x68b/0xa00 [ 511.668493] ? trace_hardirqs_on+0x310/0x310 [ 511.672911] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 511.678465] ? check_preemption_disabled+0x48/0x280 [ 511.683518] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 511.689086] ? takeover_tasklets+0xa90/0xa90 [ 511.693513] run_ksoftirqd+0x5e/0x100 [ 511.697330] smpboot_thread_fn+0x68b/0xa00 [ 511.701585] ? sort_range+0x30/0x30 [ 511.705227] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 511.710336] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 511.715883] ? __kthread_parkme+0xfb/0x1a0 [ 511.720136] ? sort_range+0x30/0x30 [ 511.723779] kthread+0x35a/0x440 [ 511.727164] ? kthread_stop+0x8f0/0x8f0 [ 511.731142] ret_from_fork+0x3a/0x50 [ 511.735784] Kernel Offset: disabled [ 511.739417] Rebooting in 86400 seconds..