7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 634.337164] binder: send failed reply for transaction 4390 to 5064:5065 [ 634.371355] binder: 5277:5281 ioctl c0306201 0 returned -14 [ 634.376593] binder: send failed reply for transaction 4391 to 5124:5126 19:25:53 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 634.389648] binder: BINDER_SET_CONTEXT_MGR already set [ 634.400197] binder: 5277:5281 ioctl 40046207 0 returned -16 19:25:53 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r0, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:25:53 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 634.436625] binder: send failed reply for transaction 4392 to 5172:5173 [ 634.453131] binder: 5285:5286 ioctl c0306201 0 returned -14 [ 634.470831] binder: undelivered TRANSACTION_COMPLETE [ 634.472641] binder: BINDER_SET_CONTEXT_MGR already set [ 634.499864] binder: undelivered TRANSACTION_ERROR: 29189 [ 634.503375] binder: 5285:5286 ioctl 40046207 0 returned -16 [ 634.537636] binder: 5292:5293 ioctl c0306201 0 returned -14 19:25:53 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 634.545649] binder: 5290:5291 ioctl c0306201 0 returned -14 [ 634.561130] binder: release 5285:5286 transaction 4402 out, still active [ 634.565129] binder: BINDER_SET_CONTEXT_MGR already set [ 634.573731] binder: undelivered TRANSACTION_COMPLETE [ 634.594135] binder: 5290:5291 ioctl 40046207 0 returned -16 [ 634.594182] binder: BINDER_SET_CONTEXT_MGR already set [ 634.594229] binder: 5292:5293 ioctl 40046207 0 returned -16 19:25:54 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 634.861039] binder: undelivered TRANSACTION_COMPLETE [ 634.866486] binder: undelivered TRANSACTION_ERROR: 29189 [ 634.886054] binder: undelivered TRANSACTION_COMPLETE [ 634.900237] binder: undelivered TRANSACTION_ERROR: 29189 [ 634.907526] binder: undelivered TRANSACTION_COMPLETE [ 634.920639] binder: undelivered TRANSACTION_ERROR: 29189 [ 634.927742] binder: undelivered TRANSACTION_COMPLETE [ 634.940797] binder: undelivered TRANSACTION_ERROR: 29189 [ 634.948033] binder: undelivered TRANSACTION_COMPLETE [ 634.961029] binder: undelivered TRANSACTION_ERROR: 29189 19:25:54 executing program 3: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 635.029365] binder: release 5275:5276 transaction 4396 out, still active [ 635.036223] binder: undelivered TRANSACTION_COMPLETE [ 635.066020] binder: undelivered TRANSACTION_ERROR: 29189 [ 635.097635] binder: send failed reply for transaction 4396, target dead [ 635.120839] binder: send failed reply for transaction 4399 to 5277:5281 19:25:54 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 635.161702] binder: 5404:5405 ioctl c0306201 0 returned -14 [ 635.168493] binder: send failed reply for transaction 4402, target dead [ 635.195109] binder: send failed reply for transaction 4403 to 5290:5291 19:25:54 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 635.252412] binder: 5407:5408 ioctl c0306201 0 returned -14 [ 635.293338] binder: undelivered TRANSACTION_ERROR: 29189 [ 635.325518] binder: BINDER_SET_CONTEXT_MGR already set 19:25:54 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 635.368889] binder: 5412:5413 ioctl c0306201 0 returned -14 [ 635.377118] binder: 5407:5408 ioctl 40046207 0 returned -16 [ 635.414854] binder: BINDER_SET_CONTEXT_MGR already set [ 635.452504] binder: 5412:5413 ioctl 40046207 0 returned -16 [ 635.468331] binder: 5415:5416 ioctl c0306201 0 returned -14 [ 635.508882] binder: BINDER_SET_CONTEXT_MGR already set [ 635.534292] binder: 5415:5416 ioctl 40046207 0 returned -16 [ 635.570308] binder: 5412:5417 BC_ACQUIRE_DONE node 4414 has no pending acquire request 19:25:54 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 635.689567] binder: undelivered TRANSACTION_ERROR: 29189 [ 635.710574] binder: 5422:5423 ioctl c0306201 0 returned -14 [ 635.712394] binder: undelivered TRANSACTION_ERROR: 29189 [ 635.740047] binder: BINDER_SET_CONTEXT_MGR already set [ 635.747620] binder: 5422:5423 ioctl 40046207 0 returned -16 19:25:55 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 635.820352] binder: 5422:5424 BC_ACQUIRE_DONE node 4417 has no pending acquire request [ 635.930444] binder: release 5404:5405 transaction 4407 out, still active [ 635.961340] binder: 5427:5428 ioctl c0306201 0 returned -14 [ 635.973193] binder: send failed reply for transaction 4407, target dead [ 635.982611] binder: send failed reply for transaction 4410 to 5407:5408 [ 636.015940] binder: send failed reply for transaction 4413 to 5412:5413 [ 636.023615] binder: send failed reply for transaction 4416 to 5422:5423 [ 636.040325] binder_alloc_new_buf_locked: 7 callbacks suppressed [ 636.040348] binder_alloc: 5427: binder_alloc_buf, no vma [ 636.102101] binder_transaction: 10 callbacks suppressed [ 636.102136] binder: 5427:5428 transaction failed 29189/-3, size 24-8 line 3035 [ 636.129633] device bridge_slave_1 left promiscuous mode [ 636.135279] bridge0: port 2(bridge_slave_1) entered disabled state [ 636.190016] device bridge_slave_0 left promiscuous mode [ 636.195583] bridge0: port 1(bridge_slave_0) entered disabled state [ 636.427884] device hsr_slave_1 left promiscuous mode [ 636.488123] device hsr_slave_0 left promiscuous mode [ 636.544725] team0 (unregistering): Port device team_slave_1 removed [ 636.555561] team0 (unregistering): Port device team_slave_0 removed [ 636.565687] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 636.605215] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 636.694455] bond0 (unregistering): Released all slaves [ 637.303752] IPVS: ftp: loaded support on port[0] = 21 [ 637.394282] chnl_net:caif_netlink_parms(): no params data found [ 637.437672] bridge0: port 1(bridge_slave_0) entered blocking state [ 637.445037] bridge0: port 1(bridge_slave_0) entered disabled state [ 637.456620] device bridge_slave_0 entered promiscuous mode [ 637.464815] bridge0: port 2(bridge_slave_1) entered blocking state [ 637.475689] bridge0: port 2(bridge_slave_1) entered disabled state [ 637.483744] device bridge_slave_1 entered promiscuous mode [ 637.507187] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 637.522533] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 637.579548] team0: Port device team_slave_0 added [ 637.585680] team0: Port device team_slave_1 added [ 637.637996] IPVS: ftp: loaded support on port[0] = 21 [ 637.701445] device hsr_slave_0 entered promiscuous mode [ 637.739474] device hsr_slave_1 entered promiscuous mode [ 637.797101] bridge0: port 2(bridge_slave_1) entered blocking state [ 637.803491] bridge0: port 2(bridge_slave_1) entered forwarding state [ 637.810144] bridge0: port 1(bridge_slave_0) entered blocking state [ 637.816488] bridge0: port 1(bridge_slave_0) entered forwarding state [ 637.832841] bridge0: port 1(bridge_slave_0) entered disabled state [ 637.845357] bridge0: port 2(bridge_slave_1) entered disabled state [ 637.934446] 8021q: adding VLAN 0 to HW filter on device bond0 [ 637.980442] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 637.987257] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 638.006489] 8021q: adding VLAN 0 to HW filter on device team0 [ 638.017436] chnl_net:caif_netlink_parms(): no params data found [ 638.033445] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 638.046547] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 638.054164] bridge0: port 1(bridge_slave_0) entered blocking state [ 638.060523] bridge0: port 1(bridge_slave_0) entered forwarding state [ 638.093344] bridge0: port 1(bridge_slave_0) entered blocking state [ 638.106628] bridge0: port 1(bridge_slave_0) entered disabled state [ 638.115010] device bridge_slave_0 entered promiscuous mode [ 638.128840] bridge0: port 2(bridge_slave_1) entered blocking state [ 638.135552] bridge0: port 2(bridge_slave_1) entered disabled state [ 638.149652] device bridge_slave_1 entered promiscuous mode [ 638.168927] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 638.178729] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 638.193020] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 638.201168] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 638.208652] bridge0: port 2(bridge_slave_1) entered blocking state [ 638.215010] bridge0: port 2(bridge_slave_1) entered forwarding state [ 638.222978] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 638.231022] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 638.238637] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 638.246355] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 638.254745] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 638.262832] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 638.270532] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 638.277878] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 638.285401] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 638.292781] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 638.310302] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 638.317344] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 638.325738] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 638.336009] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 638.353547] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 638.391102] team0: Port device team_slave_0 added [ 638.397147] team0: Port device team_slave_1 added [ 638.441646] binder: 5441:5442 ioctl c0306201 0 returned -14 [ 638.448822] binder_alloc: 5441: binder_alloc_buf, no vma [ 638.456669] binder: 5441:5442 transaction failed 29189/-3, size 24-8 line 3035 [ 638.466056] device hsr_slave_0 entered promiscuous mode [ 638.472243] binder_thread_write: 11 callbacks suppressed [ 638.472266] binder: 5441:5442 Release 1 refcount change on invalid ref 1 ret -22 [ 638.494987] binder_thread_write: 6 callbacks suppressed [ 638.495003] binder: 5441:5442 BC_ACQUIRE_DONE u0000000000000000 no match [ 638.505172] device hsr_slave_1 entered promiscuous mode [ 638.545883] bridge0: port 2(bridge_slave_1) entered blocking state [ 638.552225] bridge0: port 2(bridge_slave_1) entered forwarding state [ 638.558773] bridge0: port 1(bridge_slave_0) entered blocking state [ 638.565123] bridge0: port 1(bridge_slave_0) entered forwarding state [ 638.605243] 8021q: adding VLAN 0 to HW filter on device bond0 [ 638.616133] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 638.624489] bridge0: port 1(bridge_slave_0) entered disabled state [ 638.632009] bridge0: port 2(bridge_slave_1) entered disabled state [ 638.647410] 8021q: adding VLAN 0 to HW filter on device team0 [ 638.661625] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 638.670388] bridge0: port 1(bridge_slave_0) entered blocking state [ 638.676707] bridge0: port 1(bridge_slave_0) entered forwarding state [ 638.684012] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 638.692398] bridge0: port 2(bridge_slave_1) entered blocking state [ 638.698721] bridge0: port 2(bridge_slave_1) entered forwarding state [ 638.709992] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 638.727564] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 638.737361] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 638.748694] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 638.755844] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 638.763828] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 638.771422] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 638.778769] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 638.800943] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 638.842279] binder: 5445:5446 ioctl c0306201 0 returned -14 [ 638.848771] binder: BINDER_SET_CONTEXT_MGR already set [ 638.854754] binder: 5445:5446 ioctl 40046207 0 returned -16 [ 638.865627] binder_alloc: 5441: binder_alloc_buf, no vma [ 638.871733] binder: 5445:5446 transaction failed 29189/-3, size 24-0 line 3035 [ 638.881332] binder: 5445:5446 Release 1 refcount change on invalid ref 1 ret -22 [ 639.060556] device bridge_slave_1 left promiscuous mode [ 639.066070] bridge0: port 2(bridge_slave_1) entered disabled state [ 639.120767] device bridge_slave_0 left promiscuous mode [ 639.126286] bridge0: port 1(bridge_slave_0) entered disabled state 19:25:58 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:25:58 executing program 3: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:25:58 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:25:58 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:25:58 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:25:58 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 639.276968] device hsr_slave_1 left promiscuous mode [ 639.291854] binder: 5454:5455 ioctl c0306201 0 returned -14 [ 639.318212] binder: 5449:5450 ioctl c0306201 0 returned -14 [ 639.320282] binder: 5460:5461 ioctl c0306201 0 returned -14 [ 639.334757] binder: 5452:5453 ioctl c0306201 0 returned -14 [ 639.345622] binder_alloc: 5449: binder_alloc_buf, no vma [ 639.350466] binder: BINDER_SET_CONTEXT_MGR already set [ 639.352974] binder: 5458:5459 ioctl c0306201 0 returned -14 [ 639.357935] binder: 5454:5463 ioctl 40046207 0 returned -16 [ 639.362347] binder: 5451:5462 ioctl c0306201 0 returned -14 [ 639.374113] binder: BINDER_SET_CONTEXT_MGR already set [ 639.384688] device hsr_slave_0 left promiscuous mode [ 639.388887] binder: BINDER_SET_CONTEXT_MGR already set [ 639.391492] binder: 5449:5450 transaction failed 29189/-3, size 24-8 line 3035 [ 639.402997] binder: 5460:5464 ioctl 40046207 0 returned -16 [ 639.408824] binder: BINDER_SET_CONTEXT_MGR already set [ 639.414690] binder: 5452:5465 ioctl 40046207 0 returned -16 [ 639.421082] binder: 5451:5457 ioctl 40046207 0 returned -16 [ 639.423916] binder: BINDER_SET_CONTEXT_MGR already set [ 639.436316] binder: 5460:5461 transaction failed 29189/-22, size 24-8 line 2896 [ 639.440369] binder: 5458:5459 ioctl 40046207 0 returned -16 [ 639.444163] binder: 5452:5453 transaction failed 29189/-22, size 24-0 line 2896 [ 639.451800] binder: 5460:5461 Release 1 refcount change on invalid ref 1 ret -22 19:25:58 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 639.465928] binder: 5451:5457 transaction failed 29189/-22, size 24-8 line 2896 [ 639.477888] binder: 5452:5465 Release 1 refcount change on invalid ref 1 ret -22 [ 639.485906] binder: 5454:5455 transaction failed 29189/-22, size 24-8 line 2896 [ 639.500856] binder: 5451:5462 Release 1 refcount change on invalid ref 1 ret -22 [ 639.510010] binder: 5454:5455 Release 1 refcount change on invalid ref 1 ret -22 [ 639.519016] binder: 5458:5459 Release 1 refcount change on invalid ref 1 ret -22 [ 639.529935] binder: 5460:5464 BC_ACQUIRE_DONE u0000000000000000 no match [ 639.541277] binder: 5458:5459 BC_ACQUIRE_DONE u0000000000000000 no match [ 639.549953] binder: 5452:5473 BC_ACQUIRE_DONE u0000000000000000 no match [ 639.561928] binder: 5451:5457 BC_ACQUIRE_DONE u0000000000000000 no match 19:25:58 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:25:58 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 639.562051] binder: 5470:5471 ioctl c0306201 0 returned -14 [ 639.585441] team0 (unregistering): Port device team_slave_1 removed [ 639.598580] binder: 5454:5455 BC_ACQUIRE_DONE u0000000000000000 no match 19:25:59 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:25:59 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 639.633210] binder_alloc: 5470: binder_alloc_buf, no vma [ 639.667071] team0 (unregistering): Port device team_slave_0 removed [ 639.702376] binder: 5479:5480 ioctl c0306201 0 returned -14 [ 639.709017] binder: 5470:5471 transaction failed 29189/-3, size 24-8 line 3035 [ 639.725144] binder: 5483:5484 ioctl c0306201 0 returned -14 [ 639.738159] binder: BINDER_SET_CONTEXT_MGR already set [ 639.738635] binder: 5485:5486 ioctl c0306201 0 returned -14 [ 639.758846] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 639.772403] binder: 5479:5480 ioctl 40046207 0 returned -16 [ 639.780540] binder_alloc: 5483: binder_alloc_buf, no vma [ 639.786189] binder_alloc: 5483: binder_alloc_buf, no vma [ 639.786301] binder: 5483:5484 transaction failed 29189/-3, size 24-8 line 3035 [ 639.799912] binder: BINDER_SET_CONTEXT_MGR already set 19:25:59 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 639.803454] binder: 5483:5484 Release 1 refcount change on invalid ref 1 ret -22 [ 639.805339] binder: 5487:5489 ioctl 40046207 0 returned -16 [ 639.814357] binder: BINDER_SET_CONTEXT_MGR already set [ 639.835547] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 639.840544] binder: 5485:5486 ioctl 40046207 0 returned -16 [ 639.856041] binder: 5479:5490 Release 1 refcount change on invalid ref 1 ret -22 [ 639.870578] binder: 5483:5484 BC_ACQUIRE_DONE u0000000000000000 no match [ 639.878093] binder: 5487:5499 Release 1 refcount change on invalid ref 1 ret -22 [ 639.889800] binder: 5494:5496 ioctl c0306201 0 returned -14 19:25:59 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:25:59 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 639.905118] binder: 5479:5480 BC_ACQUIRE_DONE u0000000000000000 no match [ 639.908659] binder: 5485:5486 BC_ACQUIRE_DONE u0000000000000000 no match [ 639.935177] binder_alloc: 5494: binder_alloc_buf, no vma [ 639.942583] binder_alloc: 5483: binder_alloc_buf, no vma 19:25:59 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x0, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 640.006554] binder_alloc: 5483: binder_alloc_buf, no vma [ 640.008695] binder: 5507:5511 ioctl c0306201 0 returned -14 [ 640.013630] binder: 5508:5509 ioctl c0306201 0 returned -14 [ 640.028186] binder_release_work: 1 callbacks suppressed [ 640.028192] binder: undelivered TRANSACTION_ERROR: 29189 [ 640.041289] binder: 5487:5489 BC_ACQUIRE_DONE u0000000000000000 no match 19:25:59 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 640.060974] binder: BINDER_SET_CONTEXT_MGR already set [ 640.073787] binder: 5507:5511 ioctl 40046207 0 returned -16 [ 640.085068] binder: 5513:5516 ioctl c0306201 0 returned -14 19:25:59 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:25:59 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 640.111470] binder: 5515:5517 ioctl c0306201 0 returned -14 [ 640.134135] binder: BINDER_SET_CONTEXT_MGR already set [ 640.147428] binder: 5513:5516 ioctl 40046207 0 returned -16 [ 640.154230] binder: BINDER_SET_CONTEXT_MGR already set 19:25:59 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 640.175365] binder: 5523:5524 ioctl c0306201 0 returned -14 [ 640.182369] binder: 5515:5517 ioctl 40046207 0 returned -16 [ 640.214908] binder: release 5513:5516 transaction 4446 out, still active 19:25:59 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x0, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 640.228137] binder: 5526:5530 ioctl c0306201 0 returned -14 [ 640.234230] binder: BINDER_SET_CONTEXT_MGR already set [ 640.240168] binder_release_work: 6 callbacks suppressed [ 640.240172] binder: undelivered TRANSACTION_COMPLETE [ 640.260198] binder: 5523:5524 ioctl 40046207 0 returned -16 [ 640.266125] binder: BINDER_SET_CONTEXT_MGR already set [ 640.269008] binder: 5531:5532 ioctl c0306201 0 returned -14 19:25:59 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 640.298019] bond0 (unregistering): Released all slaves [ 640.304470] binder: 5526:5530 ioctl 40046207 0 returned -16 [ 640.323291] binder: BINDER_SET_CONTEXT_MGR already set [ 640.330504] binder: 5531:5532 ioctl 40046207 0 returned -16 [ 640.330694] binder: release 5526:5536 transaction 4450 out, still active [ 640.356847] binder: 5535:5538 ioctl c0306201 0 returned -14 [ 640.368144] binder: BINDER_SET_CONTEXT_MGR already set [ 640.377815] binder: 5535:5538 ioctl 40046207 0 returned -16 [ 640.387509] binder: 5540:5541 ioctl c0306201 0 returned -14 19:25:59 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x0, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 640.402615] binder: BINDER_SET_CONTEXT_MGR already set [ 640.408185] binder: 5540:5541 ioctl 40046207 0 returned -16 [ 640.476362] binder: 5544:5545 ioctl c0306201 0 returned -14 [ 640.498013] binder: BINDER_SET_CONTEXT_MGR already set [ 640.503776] binder: 5540:5546 BC_ACQUIRE_DONE node 4455 has no pending acquire request [ 640.513036] binder: 5544:5545 ioctl 40046207 0 returned -16 19:26:00 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 640.764535] binder: release 5508:5509 transaction 4440 out, still active [ 640.792092] binder: send failed reply for transaction 4440, target dead [ 640.799613] binder: send failed reply for transaction 4443 to 5507:5520 [ 640.816100] binder: send failed reply for transaction 4446, target dead [ 640.834482] binder: send failed reply for transaction 4447 to 5515:5517 [ 640.851288] binder: send failed reply for transaction 4450, target dead 19:26:00 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 640.867783] binder: send failed reply for transaction 4453 to 5535:5538 [ 640.885092] binder: 5550:5551 ioctl c0306201 0 returned -14 [ 640.888917] binder: send failed reply for transaction 4454 to 5540:5541 [ 640.906251] binder: send failed reply for transaction 4457 to 5544:5545 19:26:00 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x0, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:00 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 640.935298] binder: 5553:5554 ioctl c0306201 0 returned -14 [ 640.961094] binder: BINDER_SET_CONTEXT_MGR already set [ 640.966473] binder: 5553:5554 ioctl 40046207 0 returned -16 19:26:00 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:00 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 640.990368] binder: release 5550:5555 transaction 4459 out, still active 19:26:00 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x0, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 641.054708] binder: 5562:5563 ioctl c0306201 0 returned -14 [ 641.076623] binder: BINDER_SET_CONTEXT_MGR already set [ 641.080950] binder: 5561:5565 ioctl c0306201 0 returned -14 [ 641.084511] binder: 5564:5567 ioctl c0306201 0 returned -14 [ 641.102545] binder: 5566:5568 ioctl c0306201 0 returned -14 [ 641.108394] binder: 5562:5563 ioctl 40046207 0 returned -16 [ 641.112407] binder: BINDER_SET_CONTEXT_MGR already set [ 641.139441] binder: BINDER_SET_CONTEXT_MGR already set [ 641.144922] binder: 5561:5565 ioctl 40046207 0 returned -16 [ 641.155411] binder: BINDER_SET_CONTEXT_MGR already set [ 641.155445] binder: 5566:5568 ioctl 40046207 0 returned -16 [ 641.162032] binder: 5564:5567 ioctl 40046207 0 returned -16 [ 641.166900] binder: 5571:5572 ioctl c0306201 0 returned -14 [ 641.179762] binder: 5562:5573 BC_ACQUIRE_DONE node 4466 has no pending acquire request 19:26:00 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:00 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x0, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:00 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 641.200836] binder: BINDER_SET_CONTEXT_MGR already set [ 641.213763] binder: 5571:5579 ioctl 40046207 0 returned -16 [ 641.219747] binder: release 5564:5577 transaction 4468 out, still active [ 641.244711] binder: release 5561:5565 transaction 4471 out, still active [ 641.277555] binder: undelivered TRANSACTION_COMPLETE [ 641.288604] binder: 5584:5586 ioctl c0306201 0 returned -14 [ 641.298581] binder: release 5571:5572 transaction 4472 out, still active [ 641.324872] binder: undelivered TRANSACTION_COMPLETE [ 641.333743] binder: BINDER_SET_CONTEXT_MGR already set [ 641.342115] binder: 5588:5589 ioctl c0306201 0 returned -14 [ 641.361156] binder: 5584:5586 ioctl 40046207 0 returned -16 [ 641.371534] binder: BINDER_SET_CONTEXT_MGR already set 19:26:00 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x0, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 641.378344] binder: 5587:5590 ioctl c0306201 0 returned -14 [ 641.378946] binder: 5588:5589 ioctl 40046207 0 returned -16 [ 641.413811] binder: BINDER_SET_CONTEXT_MGR already set [ 641.430689] binder: 5584:5592 BC_ACQUIRE_DONE node 4474 has no pending acquire request [ 641.452272] binder: release 5588:5589 transaction 4476 out, still active [ 641.452312] binder: 5587:5590 ioctl 40046207 0 returned -16 [ 641.467565] binder: undelivered TRANSACTION_COMPLETE 19:26:00 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x0, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 641.500024] binder: 5596:5598 ioctl c0306201 0 returned -14 [ 641.513083] binder: BINDER_SET_CONTEXT_MGR already set [ 641.523181] binder: 5596:5598 ioctl 40046207 0 returned -16 [ 641.535729] binder: release 5587:5595 transaction 4477 out, still active 19:26:01 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 641.612639] binder: 5601:5602 ioctl c0306201 0 returned -14 [ 641.627466] binder: BINDER_SET_CONTEXT_MGR already set [ 641.635082] binder: 5601:5602 ioctl 40046207 0 returned -16 19:26:01 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 641.710113] binder: release 5553:5554 transaction 4462 out, still active [ 641.743337] binder: unexpected work type, 4, not freed [ 641.771715] binder: undelivered TRANSACTION_COMPLETE 19:26:01 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 641.818245] binder: 5608:5609 ioctl c0306201 0 returned -14 [ 641.822954] binder: BINDER_SET_CONTEXT_MGR already set [ 641.838755] binder: BINDER_SET_CONTEXT_MGR already set [ 641.838890] binder: 5605:5607 ioctl 40046207 0 returned -16 [ 641.849457] binder: 5608:5609 ioctl 40046207 0 returned -16 [ 641.855643] binder: unexpected work type, 4, not freed [ 641.861289] binder: undelivered TRANSACTION_COMPLETE 19:26:01 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 641.947574] binder: 5612:5617 ioctl c0306201 0 returned -14 [ 641.967453] binder: 5613:5615 ioctl c0306201 0 returned -14 [ 641.978168] binder: BINDER_SET_CONTEXT_MGR already set [ 641.986417] binder: 5612:5617 ioctl 40046207 0 returned -16 [ 641.996471] binder: BINDER_SET_CONTEXT_MGR already set [ 642.004272] binder: 5613:5615 ioctl 40046207 0 returned -16 [ 642.017582] binder: 5613:5615 got transaction with invalid offset (0, min 0 max 0) or object. [ 642.028983] binder_transaction: 4 callbacks suppressed [ 642.029019] binder: 5613:5615 transaction failed 29201/-22, size 0-8 line 3097 19:26:01 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:01 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 642.063760] binder: 5612:5618 BC_ACQUIRE_DONE node 4489 has no pending acquire request [ 642.089318] binder: unexpected work type, 4, not freed [ 642.094606] binder: undelivered TRANSACTION_COMPLETE [ 642.151720] binder: 5622:5624 ioctl c0306201 0 returned -14 [ 642.164095] binder: 5620:5623 ioctl c0306201 0 returned -14 [ 642.171685] binder: BINDER_SET_CONTEXT_MGR already set [ 642.177684] binder: BINDER_SET_CONTEXT_MGR already set [ 642.184752] binder: 5620:5623 ioctl 40046207 0 returned -16 19:26:01 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 642.197005] binder: 5622:5624 ioctl 40046207 0 returned -16 [ 642.205279] binder: 5620:5623 got transaction with invalid offset (0, min 0 max 0) or object. [ 642.220767] binder: 5620:5623 transaction failed 29201/-22, size 0-8 line 3097 19:26:01 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 642.274212] binder: 5622:5625 BC_ACQUIRE_DONE node 4494 has no pending acquire request [ 642.288314] binder: 5627:5628 ioctl c0306201 0 returned -14 [ 642.289302] binder: undelivered TRANSACTION_COMPLETE [ 642.300937] binder: BINDER_SET_CONTEXT_MGR already set [ 642.306528] binder: 5627:5628 ioctl 40046207 0 returned -16 [ 642.337379] binder: 5627:5628 got transaction with invalid offset (0, min 0 max 0) or object. [ 642.363893] binder: 5627:5628 transaction failed 29201/-22, size 0-8 line 3097 19:26:01 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 642.383567] binder: 5629:5630 ioctl c0306201 0 returned -14 [ 642.396649] binder: BINDER_SET_CONTEXT_MGR already set [ 642.408848] binder: 5629:5630 ioctl 40046207 0 returned -16 19:26:01 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 642.451778] binder: undelivered TRANSACTION_COMPLETE [ 642.511389] binder: 5635:5636 ioctl c0306201 0 returned -14 [ 642.520417] binder: BINDER_SET_CONTEXT_MGR already set [ 642.526024] binder: 5635:5636 ioctl 40046207 0 returned -16 [ 642.537364] binder: 5637:5638 ioctl c0306201 0 returned -14 [ 642.545309] binder: 5635:5636 got transaction with invalid offset (0, min 0 max 0) or object. [ 642.554691] binder: 5635:5636 transaction failed 29201/-22, size 0-8 line 3097 [ 642.559262] binder: BINDER_SET_CONTEXT_MGR already set [ 642.568543] binder: 5637:5638 ioctl 40046207 0 returned -16 19:26:01 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:01 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:01 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:02 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 642.604318] binder: undelivered TRANSACTION_COMPLETE [ 642.614050] binder: unexpected work type, 4, not freed 19:26:02 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 642.716126] binder: 5643:5644 ioctl c0306201 0 returned -14 [ 642.722470] binder: 5648:5650 ioctl c0306201 0 returned -14 [ 642.722915] binder: BINDER_SET_CONTEXT_MGR already set [ 642.755247] binder: 5647:5649 ioctl c0306201 0 returned -14 [ 642.774527] binder: unexpected work type, 4, not freed [ 642.782391] binder: 5648:5650 ioctl 40046207 0 returned -16 [ 642.784924] binder: BINDER_SET_CONTEXT_MGR already set [ 642.803063] binder: 5654:5655 ioctl c0306201 0 returned -14 [ 642.812908] binder: BINDER_SET_CONTEXT_MGR already set [ 642.812941] binder: 5645:5646 ioctl 40046207 0 returned -16 [ 642.849519] binder: 5643:5651 ioctl 40046207 0 returned -16 [ 642.850047] binder: BINDER_SET_CONTEXT_MGR already set [ 642.862126] binder: BINDER_SET_CONTEXT_MGR already set [ 642.868063] binder: 5654:5655 ioctl 40046207 0 returned -16 [ 642.875440] binder: 5647:5656 got transaction with invalid offset (0, min 0 max 0) or object. [ 642.876633] binder: 5647:5649 ioctl 40046207 0 returned -16 19:26:02 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 642.897253] binder: 5647:5656 transaction failed 29201/-22, size 0-8 line 3097 19:26:02 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:02 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 642.941164] binder: 5654:5662 BC_ACQUIRE_DONE node 4509 has no pending acquire request [ 642.959617] binder: unexpected work type, 4, not freed [ 643.007881] binder: 5665:5666 ioctl c0306201 0 returned -14 [ 643.030019] binder: 5669:5670 ioctl c0306201 0 returned -14 [ 643.047619] binder: 5671:5672 ioctl c0306201 0 returned -14 [ 643.052770] binder: BINDER_SET_CONTEXT_MGR already set [ 643.059323] binder: 5665:5666 ioctl 40046207 0 returned -16 [ 643.059348] binder: BINDER_SET_CONTEXT_MGR already set [ 643.065224] binder: 5669:5670 ioctl 40046207 0 returned -16 [ 643.077665] binder: BINDER_SET_CONTEXT_MGR already set [ 643.085267] binder: 5671:5672 ioctl 40046207 0 returned -16 19:26:02 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 643.117328] binder: 5665:5666 got transaction with invalid offset (0, min 0 max 0) or object. [ 643.126654] binder: 5665:5666 transaction failed 29201/-22, size 0-8 line 3097 [ 643.143044] binder: 5671:5674 BC_ACQUIRE_DONE node 4515 has no pending acquire request [ 643.151692] binder: 5669:5673 BC_ACQUIRE_DONE node 4512 has no pending acquire request [ 643.201205] binder: 5678:5679 ioctl c0306201 0 returned -14 [ 643.213267] binder: BINDER_SET_CONTEXT_MGR already set [ 643.218892] binder: 5678:5679 ioctl 40046207 0 returned -16 [ 643.232057] binder: 5678:5679 got transaction with invalid offset (0, min 0 max 0) or object. [ 643.242394] binder: 5678:5679 transaction failed 29201/-22, size 0-8 line 3097 19:26:02 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:02 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) [ 643.311486] binder: 5681:5682 ioctl c0306201 0 returned -14 [ 643.320317] binder: BINDER_SET_CONTEXT_MGR already set [ 643.325851] binder: 5681:5682 ioctl 40046207 0 returned -16 [ 643.339778] binder: 5681:5682 got transaction with invalid offset (0, min 0 max 0) or object. [ 643.348865] binder: 5681:5682 transaction failed 29201/-22, size 0-8 line 3097 [ 643.412212] binder: 5684:5685 ioctl c0306201 0 returned -14 [ 643.418956] binder: BINDER_SET_CONTEXT_MGR already set [ 643.428519] binder: 5684:5685 ioctl 40046207 0 returned -16 [ 643.437845] binder: 5684:5685 got transaction with invalid offset (0, min 0 max 0) or object. [ 643.450678] binder: 5684:5685 transaction failed 29201/-22, size 0-8 line 3097 19:26:02 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 643.466180] binder: undelivered TRANSACTION_ERROR: 29201 [ 643.472414] binder: unexpected work type, 4, not freed 19:26:02 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:02 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) 19:26:02 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 643.508469] binder: undelivered TRANSACTION_ERROR: 29201 [ 643.559504] binder: 5687:5688 ioctl c0306201 0 returned -14 [ 643.588844] binder: BINDER_SET_CONTEXT_MGR already set [ 643.598595] binder: 5691:5692 ioctl c0306201 0 returned -14 [ 643.602953] binder: 5687:5688 ioctl 40046207 0 returned -16 [ 643.615490] binder: 5694:5696 ioctl c0306201 0 returned -14 [ 643.631310] binder: BINDER_SET_CONTEXT_MGR already set [ 643.637869] binder: 5693:5695 ioctl c0306201 0 returned -14 [ 643.644186] binder: 5691:5692 ioctl 40046207 0 returned -16 [ 643.644257] binder: BINDER_SET_CONTEXT_MGR already set [ 643.659861] binder: 5694:5696 ioctl 40046207 0 returned -16 [ 643.660020] binder: BINDER_SET_CONTEXT_MGR already set [ 643.672267] binder: 5691:5692 got transaction with invalid offset (0, min 0 max 0) or object. [ 643.674468] binder_thread_write: 38 callbacks suppressed [ 643.674540] binder: 5694:5696 Release 1 refcount change on invalid ref 1 ret -22 [ 643.681542] binder: 5693:5695 ioctl 40046207 0 returned -16 [ 643.707103] binder_thread_write: 14 callbacks suppressed 19:26:03 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 643.707152] binder: 5694:5696 BC_ACQUIRE_DONE u0000000000000000 no match [ 643.707874] binder: 5691:5692 transaction failed 29201/-22, size 0-8 line 3097 [ 643.737322] binder: 5691:5700 Release 1 refcount change on invalid ref 1 ret -22 [ 643.745790] binder: 5693:5695 Release 1 refcount change on invalid ref 1 ret -22 19:26:03 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) 19:26:03 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 643.770522] binder: undelivered TRANSACTION_ERROR: 29201 [ 643.782145] binder: 5703:5704 ioctl c0306201 0 returned -14 [ 643.797626] binder: BINDER_SET_CONTEXT_MGR already set 19:26:03 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 643.823554] binder: 5703:5704 ioctl 40046207 0 returned -16 [ 643.842145] binder: unexpected work type, 4, not freed [ 643.853730] binder: 5706:5707 ioctl c0306201 0 returned -14 [ 643.855010] binder: 5703:5704 Release 1 refcount change on invalid ref 1 ret -22 [ 643.870709] binder: unexpected work type, 4, not freed [ 643.890919] binder: BINDER_SET_CONTEXT_MGR already set [ 643.899290] binder: 5706:5707 ioctl 40046207 0 returned -16 [ 643.911779] binder: 5703:5708 BC_ACQUIRE_DONE u0000000000000000 no match 19:26:03 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 643.919236] binder: 5710:5711 ioctl c0306201 0 returned -14 [ 643.924915] binder: 5706:5707 Release 1 refcount change on invalid ref 1 ret -22 [ 643.927212] binder: undelivered TRANSACTION_ERROR: 29201 [ 643.942844] binder: BINDER_SET_CONTEXT_MGR already set [ 643.958148] binder: 5712:5713 ioctl c0306201 0 returned -14 [ 643.964962] binder: 5710:5711 ioctl 40046207 0 returned -16 19:26:03 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:03 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) [ 643.975816] binder: BINDER_SET_CONTEXT_MGR already set [ 643.989401] binder: 5712:5713 ioctl 40046207 0 returned -16 [ 643.996883] binder: 5710:5711 Release 1 refcount change on invalid ref 1 ret -22 [ 644.028442] binder: 5717:5718 ioctl c0306201 0 returned -14 [ 644.044289] binder: BINDER_SET_CONTEXT_MGR already set [ 644.062878] binder: 5721:5724 ioctl c0306201 0 returned -14 [ 644.066118] binder: 5717:5718 ioctl 40046207 0 returned -16 [ 644.075013] binder: 5712:5725 Release 1 refcount change on invalid ref 1 ret -22 [ 644.087020] binder: BINDER_SET_CONTEXT_MGR already set [ 644.088880] binder: 5722:5723 ioctl c0306201 0 returned -14 [ 644.092871] binder: 5721:5724 ioctl 40046207 0 returned -16 [ 644.104105] binder: BINDER_SET_CONTEXT_MGR already set [ 644.104156] binder: 5722:5723 ioctl 40046207 0 returned -16 19:26:03 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 644.113476] binder: 5722:5723 Release 1 refcount change on invalid ref 1 ret -22 [ 644.118480] binder: 5712:5725 BC_ACQUIRE_DONE node 4531 has no pending acquire request [ 644.122697] binder: 5717:5727 Release 1 refcount change on invalid ref 1 ret -22 [ 644.137128] binder: 5710:5711 BC_ACQUIRE_DONE u0000000000000000 no match [ 644.144607] binder: 5717:5727 BC_ACQUIRE_DONE node 4534 has no pending acquire request [ 644.147516] binder: 5721:5729 Release 1 refcount change on invalid ref 1 ret -22 [ 644.159286] binder: undelivered TRANSACTION_ERROR: 29201 [ 644.186234] binder: 5721:5724 BC_ACQUIRE_DONE u0000000000000000 no match [ 644.247138] binder: 5733:5734 ioctl c0306201 0 returned -14 [ 644.254732] binder: BINDER_SET_CONTEXT_MGR already set [ 644.261034] binder: 5733:5734 ioctl 40046207 0 returned -16 19:26:03 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:03 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, 0x0, &(0x7f0000000140)) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:03 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:03 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) [ 644.315073] binder: 5733:5737 BC_ACQUIRE_DONE node 4539 has no pending acquire request [ 644.336064] binder: unexpected work type, 4, not freed [ 644.372264] binder: 5740:5745 ioctl c0306201 0 returned -14 [ 644.377109] binder: 5742:5743 ioctl c0306201 0 returned -14 [ 644.390059] binder: 5739:5744 ioctl c0306201 0 returned -14 [ 644.395044] binder: BINDER_SET_CONTEXT_MGR already set [ 644.403076] binder: BINDER_SET_CONTEXT_MGR already set [ 644.408658] binder: 5742:5743 ioctl 40046207 0 returned -16 [ 644.415207] binder: 5740:5745 ioctl 40046207 0 returned -16 [ 644.417803] binder: BINDER_SET_CONTEXT_MGR already set [ 644.439338] binder: 5739:5744 ioctl 40046207 0 returned -16 [ 644.454737] binder: undelivered TRANSACTION_ERROR: 29201 [ 644.459965] binder: 5746:5747 ioctl c0306201 0 returned -14 19:26:03 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) [ 644.467330] binder: 5740:5745 BC_ACQUIRE_DONE u0000000000000000 no match 19:26:03 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 644.522351] binder: 5754:5755 ioctl c0306201 0 returned -14 [ 644.543160] binder: BINDER_SET_CONTEXT_MGR already set [ 644.548701] binder: 5754:5755 ioctl 40046207 0 returned -16 [ 644.557615] binder: 5757:5758 ioctl c0306201 0 returned -14 [ 644.564799] binder: undelivered TRANSACTION_ERROR: 29201 19:26:04 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:04 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) [ 644.725871] binder: 5762:5763 ioctl c0306201 0 returned -14 [ 644.733340] binder: BINDER_SET_CONTEXT_MGR already set [ 644.739582] binder: 5762:5763 ioctl 40046207 0 returned -16 [ 644.754445] binder: 5764:5765 ioctl c0306201 0 returned -14 [ 644.769512] binder: undelivered TRANSACTION_ERROR: 29201 19:26:04 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 644.775625] binder: BINDER_SET_CONTEXT_MGR already set [ 644.781248] binder: 5764:5765 ioctl 40046207 0 returned -16 [ 644.797832] binder: 5764:5765 BC_ACQUIRE_DONE u0000000000000000 no match 19:26:04 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 644.828864] binder: 5767:5768 ioctl c0306201 0 returned -14 [ 644.837235] binder: BINDER_SET_CONTEXT_MGR already set [ 644.844243] binder: 5767:5768 ioctl 40046207 0 returned -16 [ 644.859265] binder: undelivered TRANSACTION_ERROR: 29201 19:26:04 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 644.902974] binder: 5770:5771 ioctl c0306201 0 returned -14 [ 644.910446] binder: BINDER_SET_CONTEXT_MGR already set [ 644.915933] binder: 5770:5771 ioctl 40046207 0 returned -16 [ 644.964441] binder: 5773:5774 ioctl c0306201 0 returned -14 [ 644.972562] binder: BINDER_SET_CONTEXT_MGR already set [ 644.977980] binder: 5773:5774 ioctl 40046207 0 returned -16 19:26:04 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:04 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 645.037275] binder: unexpected work type, 4, not freed [ 645.063357] binder: 5776:5777 ioctl c0306201 0 returned -14 [ 645.070047] binder: BINDER_SET_CONTEXT_MGR already set [ 645.076650] binder: 5776:5777 ioctl 40046207 0 returned -16 [ 645.085514] binder: 5779:5780 ioctl c0306201 0 returned -14 [ 645.086559] binder_release_work: 2 callbacks suppressed [ 645.086570] binder: undelivered TRANSACTION_ERROR: 29201 [ 645.107470] binder: BINDER_SET_CONTEXT_MGR already set [ 645.113355] binder: 5779:5780 ioctl 40046207 0 returned -16 19:26:04 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, 0x0, &(0x7f0000000140)) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:04 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 19:26:04 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 645.159316] binder: unexpected work type, 4, not freed 19:26:04 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, 0x0, &(0x7f0000000140)) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 645.246212] binder: 5788:5789 ioctl c0306201 0 returned -14 [ 645.254116] binder: BINDER_SET_CONTEXT_MGR already set [ 645.256133] binder: 5786:5787 ioctl c0306201 0 returned -14 [ 645.259522] binder: 5788:5789 ioctl 40046207 0 returned -16 [ 645.275848] binder: 5790:5791 ioctl c0306201 0 returned -14 [ 645.279593] binder: 5788:5789 BC_ACQUIRE_DONE u0000000000000000 no match [ 645.283323] binder: BINDER_SET_CONTEXT_MGR already set [ 645.301963] binder: 5790:5791 ioctl 40046207 0 returned -16 [ 645.307625] binder_thread_release: 22 callbacks suppressed [ 645.307635] binder: release 5788:5789 transaction 4562 out, still active [ 645.335721] binder_release_work: 13 callbacks suppressed [ 645.335726] binder: undelivered TRANSACTION_COMPLETE 19:26:04 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 645.362121] binder: 5794:5795 ioctl c0306201 0 returned -14 [ 645.367648] binder: release 5757:5758 transaction 4550 out, still active [ 645.370705] binder: BINDER_SET_CONTEXT_MGR already set [ 645.380929] binder: 5794:5795 ioctl 40046207 0 returned -16 [ 645.400533] binder: unexpected work type, 4, not freed [ 645.415286] binder: 5799:5800 ioctl c0306201 0 returned -14 [ 645.426437] binder: undelivered TRANSACTION_COMPLETE [ 645.432115] binder: undelivered TRANSACTION_ERROR: 29201 [ 645.435174] binder: 5794:5795 BC_ACQUIRE_DONE u0000000000000000 no match [ 645.446911] binder: release 5794:5795 transaction 4567 out, still active 19:26:04 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:04 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 19:26:04 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:04 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 645.563341] binder: 5806:5807 ioctl c0306201 0 returned -14 [ 645.566181] binder: undelivered TRANSACTION_ERROR: 29201 [ 645.579890] binder: 5810:5811 ioctl c0306201 0 returned -14 [ 645.586622] binder: BINDER_SET_CONTEXT_MGR already set [ 645.593644] binder: 5806:5807 ioctl 40046207 0 returned -16 [ 645.599491] binder: BINDER_SET_CONTEXT_MGR already set [ 645.599638] binder: 5810:5811 ioctl 40046207 0 returned -16 19:26:05 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 645.636279] binder: 5810:5811 BC_ACQUIRE_DONE u0000000000000000 no match [ 645.657436] binder: 5806:5807 BC_ACQUIRE_DONE u0000000000000000 no match [ 645.664827] binder: release 5806:5807 transaction 4573 out, still active [ 645.684474] binder: undelivered TRANSACTION_ERROR: 29201 [ 645.720833] binder: 5817:5818 ioctl c0306201 0 returned -14 [ 645.727645] binder: BINDER_SET_CONTEXT_MGR already set [ 645.734567] binder: 5817:5818 ioctl 40046207 0 returned -16 19:26:05 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:05 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 19:26:05 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 645.879191] binder: release 5779:5780 transaction 4559 out, still active [ 645.886054] binder: unexpected work type, 4, not freed [ 645.901069] binder: undelivered TRANSACTION_COMPLETE [ 645.922966] binder: undelivered TRANSACTION_ERROR: 29201 19:26:05 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 645.976157] binder: 5826:5828 ioctl c0306201 0 returned -14 [ 645.990183] binder: BINDER_SET_CONTEXT_MGR already set [ 645.999258] binder: 5826:5828 ioctl 40046207 0 returned -16 19:26:05 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:05 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 646.029498] binder: release 5790:5791 transaction 4564 out, still active [ 646.042180] binder: unexpected work type, 4, not freed [ 646.059076] binder: undelivered TRANSACTION_COMPLETE [ 646.116664] binder: 5838:5839 ioctl c0306201 0 returned -14 [ 646.127509] binder: BINDER_SET_CONTEXT_MGR already set [ 646.133482] binder: 5838:5839 ioctl 40046207 0 returned -16 19:26:05 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 646.191366] binder_thread_write: 4 callbacks suppressed [ 646.191382] binder: 5838:5841 BC_ACQUIRE_DONE node 4581 has no pending acquire request [ 646.205781] binder: release 5799:5800 transaction 4568 out, still active [ 646.216746] binder: unexpected work type, 4, not freed [ 646.222106] binder: undelivered TRANSACTION_COMPLETE [ 646.258905] binder: BINDER_SET_CONTEXT_MGR already set [ 646.275429] binder: 5844:5845 ioctl 40046207 0 returned -16 [ 646.294012] binder: release 5844:5845 transaction 4583 out, still active 19:26:05 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 19:26:05 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:05 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:05 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 646.393838] binder: undelivered TRANSACTION_ERROR: 29201 [ 646.396958] binder: BINDER_SET_CONTEXT_MGR already set [ 646.408569] binder: 5848:5850 ioctl 40046207 0 returned -16 [ 646.425739] binder: 5852:5853 ioctl c0306201 0 returned -14 [ 646.449268] binder: release 5848:5850 transaction 4587 out, still active [ 646.458412] binder: undelivered TRANSACTION_ERROR: 29201 [ 646.468040] binder: BINDER_SET_CONTEXT_MGR already set [ 646.489056] binder: 5852:5853 ioctl 40046207 0 returned -16 19:26:05 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 646.509240] binder: release 5817:5818 transaction 4575 out, still active [ 646.516094] binder: undelivered TRANSACTION_COMPLETE [ 646.556027] binder: 5860:5861 ioctl c0306201 0 returned -14 [ 646.563018] binder: BINDER_SET_CONTEXT_MGR already set [ 646.568536] binder: 5860:5861 ioctl 40046207 0 returned -16 19:26:06 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 19:26:06 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 646.779165] binder: unexpected work type, 4, not freed [ 646.784461] binder: undelivered TRANSACTION_COMPLETE [ 646.815541] binder: BINDER_SET_CONTEXT_MGR already set 19:26:06 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 646.826874] binder: undelivered TRANSACTION_ERROR: 29201 [ 646.839696] binder: 5864:5866 ioctl 40046207 0 returned -16 [ 646.848036] binder: 5868:5869 ioctl c0306201 0 returned -14 [ 646.874010] binder: BINDER_SET_CONTEXT_MGR already set 19:26:06 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:06 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 19:26:06 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 646.895397] binder: 5868:5869 ioctl 40046207 0 returned -16 [ 646.909547] binder: unexpected work type, 4, not freed [ 646.919894] binder: undelivered TRANSACTION_COMPLETE [ 646.966775] binder: 5876:5877 ioctl c0306201 0 returned -14 [ 646.984024] binder: 5868:5881 BC_ACQUIRE_DONE node 4598 has no pending acquire request [ 646.997741] binder: BINDER_SET_CONTEXT_MGR already set [ 647.006818] binder: 5880:5884 ioctl c0306201 0 returned -14 19:26:06 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 19:26:06 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 647.011644] binder: 5876:5877 ioctl 40046207 0 returned -16 [ 647.023010] binder: BINDER_SET_CONTEXT_MGR already set [ 647.028427] binder: 5880:5884 ioctl 40046207 0 returned -16 [ 647.090747] binder: 5880:5890 BC_ACQUIRE_DONE node 4604 has no pending acquire request [ 647.130438] binder: 5893:5894 ioctl c0306201 0 returned -14 [ 647.137379] binder: BINDER_SET_CONTEXT_MGR already set [ 647.144029] binder: 5893:5894 ioctl 40046207 0 returned -16 19:26:06 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 647.214128] binder: undelivered TRANSACTION_COMPLETE [ 647.238789] binder_transaction: 20 callbacks suppressed [ 647.238803] binder: 5898:5899 got transaction with invalid offset (0, min 0 max 0) or object. [ 647.253521] binder_transaction: 20 callbacks suppressed [ 647.253537] binder: 5898:5899 transaction failed 29201/-22, size 0-8 line 3097 [ 647.257156] binder: 5900:5901 ioctl c0306201 0 returned -14 [ 647.260973] binder: undelivered TRANSACTION_ERROR: 29201 [ 647.273960] binder: BINDER_SET_CONTEXT_MGR already set [ 647.288957] binder: 5900:5901 ioctl 40046207 0 returned -16 19:26:06 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 647.343945] binder: undelivered TRANSACTION_COMPLETE [ 647.386466] binder: 5904:5905 ioctl c0306201 0 returned -14 [ 647.393406] binder: BINDER_SET_CONTEXT_MGR already set [ 647.398952] binder: 5904:5905 ioctl 40046207 0 returned -16 19:26:06 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:06 executing program 5: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 19:26:07 executing program 5: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 647.639253] binder: unexpected work type, 4, not freed 19:26:07 executing program 5: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 647.716612] binder: 5910:5911 ioctl c0306201 0 returned -14 [ 647.723944] binder: BINDER_SET_CONTEXT_MGR already set [ 647.739921] binder: 5910:5911 ioctl 40046207 0 returned -16 19:26:07 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 19:26:07 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 647.793125] binder: unexpected work type, 4, not freed [ 647.794813] binder: 5910:5919 BC_ACQUIRE_DONE node 4613 has no pending acquire request [ 647.844086] binder: 5922:5925 ioctl c0306201 0 returned -14 [ 647.875740] binder: 5926:5927 ioctl c0306201 0 returned -14 [ 647.878690] binder: 5923:5928 ioctl c0306201 0 returned -14 [ 647.885303] binder: BINDER_SET_CONTEXT_MGR already set 19:26:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 647.893619] binder: 5926:5927 ioctl 40046207 0 returned -16 [ 647.894545] binder: BINDER_SET_CONTEXT_MGR already set [ 647.921982] binder: 5923:5928 ioctl 40046207 0 returned -16 19:26:07 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 647.944798] binder: 5930:5931 ioctl c0306201 0 returned -14 [ 647.955827] binder: 5926:5933 BC_ACQUIRE_DONE node 4616 has no pending acquire request [ 647.983150] binder: 5923:5938 BC_ACQUIRE_DONE node 4619 has no pending acquire request [ 647.990040] binder: 5935:5937 ioctl c0306201 0 returned -14 [ 648.005035] binder: BINDER_SET_CONTEXT_MGR already set [ 648.013681] binder: 5935:5937 ioctl 40046207 0 returned -16 19:26:07 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:07 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 648.079393] binder: 5942:5943 ioctl c0306201 0 returned -14 [ 648.084722] binder: 5944:5945 ioctl c0306201 0 returned -14 [ 648.086313] binder: BINDER_SET_CONTEXT_MGR already set [ 648.097944] binder: 5942:5943 ioctl 40046207 0 returned -16 [ 648.098267] binder: BINDER_SET_CONTEXT_MGR already set [ 648.112475] binder: 5944:5945 ioctl 40046207 0 returned -16 19:26:07 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 19:26:07 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 648.154153] binder: 5942:5948 BC_ACQUIRE_DONE node 4625 has no pending acquire request [ 648.201555] binder: 5950:5951 ioctl c0306201 0 returned -14 [ 648.214576] binder: 5955:5956 ioctl c0306201 0 returned -14 [ 648.222270] binder: BINDER_SET_CONTEXT_MGR already set [ 648.225704] binder: 5952:5953 ioctl c0306201 0 returned -14 [ 648.227794] binder: 5955:5956 ioctl 40046207 0 returned -16 [ 648.239018] binder: BINDER_SET_CONTEXT_MGR already set 19:26:07 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) [ 648.249946] binder: 5952:5953 ioctl 40046207 0 returned -16 19:26:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 19:26:07 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) [ 648.318017] binder: 5952:5965 BC_ACQUIRE_DONE node 4630 has no pending acquire request [ 648.332330] binder: 5960:5962 ioctl c0306201 0 returned -14 [ 648.344414] binder: BINDER_SET_CONTEXT_MGR already set [ 648.353162] binder: 5960:5962 ioctl 40046207 0 returned -16 19:26:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 648.429013] binder: 5974:5975 ioctl c0306201 0 returned -14 [ 648.445586] binder: BINDER_SET_CONTEXT_MGR already set [ 648.455733] binder: 5974:5975 ioctl 40046207 0 returned -16 19:26:08 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 648.777710] binder: unexpected work type, 4, not freed [ 648.798873] binder: 5983:5984 ioctl c0306201 0 returned -14 19:26:08 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:08 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 19:26:08 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 648.869391] binder: unexpected work type, 4, not freed [ 648.919780] binder: 5992:5993 ioctl c0306201 0 returned -14 [ 648.926776] binder: 5989:5990 ioctl c0306201 0 returned -14 [ 648.938627] binder: BINDER_SET_CONTEXT_MGR already set [ 648.953713] binder: 5992:5993 ioctl 40046207 0 returned -16 [ 648.954890] binder: BINDER_SET_CONTEXT_MGR already set [ 648.975490] binder: 5994:5995 ioctl c0306201 0 returned -14 [ 648.991505] binder: 5989:5990 ioctl 40046207 0 returned -16 [ 648.992905] binder_thread_write: 31 callbacks suppressed [ 648.992967] binder: 5992:5993 Release 1 refcount change on invalid ref 1 ret -22 [ 649.005789] binder: 5989:5990 Release 1 refcount change on invalid ref 1 ret -22 [ 649.018491] binder: BINDER_SET_CONTEXT_MGR already set 19:26:08 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 19:26:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 649.025363] binder: 5994:5995 ioctl 40046207 0 returned -16 [ 649.037355] binder_thread_write: 8 callbacks suppressed [ 649.037398] binder: 5989:5990 BC_ACQUIRE_DONE u0000000000000000 no match [ 649.038451] binder: 5992:5993 BC_ACQUIRE_DONE u0000000000000000 no match 19:26:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 649.083746] binder: 5994:5997 Release 1 refcount change on invalid ref 1 ret -22 [ 649.121885] binder: 6002:6004 ioctl c0306201 0 returned -14 19:26:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) 19:26:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 649.133808] binder: 5994:5997 BC_ACQUIRE_DONE node 4640 has no pending acquire request [ 649.144363] binder: BINDER_SET_CONTEXT_MGR already set [ 649.156429] binder: 6002:6004 ioctl 40046207 0 returned -16 19:26:08 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 649.213924] binder: 6002:6015 Release 1 refcount change on invalid ref 1 ret -22 [ 649.224808] binder: 6002:6015 BC_ACQUIRE_DONE node 4645 has no pending acquire request [ 649.271881] binder: 6021:6022 ioctl c0306201 0 returned -14 [ 649.281269] binder: BINDER_SET_CONTEXT_MGR already set [ 649.286778] binder: 6021:6022 ioctl 40046207 0 returned -16 [ 649.342712] binder: 6021:6023 Release 1 refcount change on invalid ref 1 ret -22 19:26:08 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 649.617524] binder: 6026:6028 ioctl c0306201 0 returned -14 19:26:09 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:09 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 19:26:09 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:09 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 649.749880] binder: unexpected work type, 4, not freed [ 649.757936] binder: 6032:6033 ioctl c0306201 0 returned -14 [ 649.765701] binder: BINDER_SET_CONTEXT_MGR already set [ 649.776183] binder: 6032:6033 ioctl 40046207 0 returned -16 [ 649.787674] binder: 6032:6033 Release 1 refcount change on invalid ref 1 ret -22 19:26:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 649.805440] binder: 6034:6036 ioctl c0306201 0 returned -14 [ 649.821604] binder: 6037:6039 ioctl c0306201 0 returned -14 [ 649.831012] binder: 6032:6033 BC_ACQUIRE_DONE u0000000000000000 no match [ 649.842099] binder: BINDER_SET_CONTEXT_MGR already set 19:26:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 649.869302] binder: 6037:6039 ioctl 40046207 0 returned -16 [ 649.869472] binder: BINDER_SET_CONTEXT_MGR already set [ 649.885501] binder: 6034:6036 ioctl 40046207 0 returned -16 [ 649.901372] binder: 6037:6039 Release 1 refcount change on invalid ref 1 ret -22 19:26:09 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 649.917337] binder: 6041:6044 ioctl c0306201 0 returned -14 [ 649.928454] binder: BINDER_SET_CONTEXT_MGR already set [ 649.937068] binder: 6041:6044 ioctl 40046207 0 returned -16 [ 649.937348] binder: 6047:6048 got transaction with invalid offset (0, min 0 max 0) or object. [ 649.951081] binder: 6037:6039 BC_ACQUIRE_DONE u0000000000000000 no match [ 649.959366] binder: 6047:6048 transaction failed 29201/-22, size 0-8 line 3097 19:26:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 649.979058] binder: undelivered TRANSACTION_ERROR: 29201 [ 649.982345] binder: 6034:6049 Release 1 refcount change on invalid ref 1 ret -22 [ 650.005906] binder: 6052:6053 ioctl c0306201 0 returned -14 [ 650.012367] binder: 6041:6055 Release 1 refcount change on invalid ref 1 ret -22 [ 650.037545] binder: 6057:6058 got transaction with invalid offset (0, min 0 max 0) or object. [ 650.046873] binder: 6057:6058 transaction failed 29201/-22, size 0-8 line 3097 [ 650.055483] binder: BINDER_SET_CONTEXT_MGR already set [ 650.061315] binder: 6052:6053 ioctl 40046207 0 returned -16 19:26:09 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:09 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 650.081951] binder: 6052:6053 Release 1 refcount change on invalid ref 1 ret -22 [ 650.159316] binder: 6065:6066 ioctl c0306201 0 returned -14 [ 650.166141] binder: BINDER_SET_CONTEXT_MGR already set [ 650.173059] binder: 6065:6066 ioctl 40046207 0 returned -16 [ 650.181505] binder: 6063:6064 ioctl c0306201 0 returned -14 [ 650.194493] binder: BINDER_SET_CONTEXT_MGR already set [ 650.203035] binder: 6063:6064 ioctl 40046207 0 returned -16 19:26:09 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 650.419508] binder_thread_release: 29 callbacks suppressed [ 650.419515] binder: release 6026:6028 transaction 4652 out, still active [ 650.436633] binder: unexpected work type, 4, not freed [ 650.449931] binder_release_work: 20 callbacks suppressed [ 650.449935] binder: undelivered TRANSACTION_COMPLETE [ 650.472831] binder: 6072:6073 ioctl c0306201 0 returned -14 19:26:09 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 650.544273] binder: release 6032:6033 transaction 4655 out, still active [ 650.551395] binder: undelivered TRANSACTION_COMPLETE [ 650.573459] binder: 6076:6077 ioctl c0306201 0 returned -14 [ 650.580546] binder: BINDER_SET_CONTEXT_MGR already set [ 650.586096] binder: 6076:6077 ioctl 40046207 0 returned -16 [ 650.586593] binder: release 6034:6036 transaction 4660 out, still active [ 650.593404] binder: unexpected work type, 4, not freed [ 650.612581] binder: undelivered TRANSACTION_COMPLETE 19:26:10 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:10 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:10 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 650.635618] binder: 6076:6077 BC_ACQUIRE_DONE u0000000000000000 no match [ 650.644696] binder: release 6041:6044 transaction 4663 out, still active [ 650.659919] binder: unexpected work type, 4, not freed [ 650.679759] binder: undelivered TRANSACTION_COMPLETE [ 650.698092] binder: 6079:6082 ioctl c0306201 0 returned -14 [ 650.704728] binder: 6080:6081 ioctl c0306201 0 returned -14 [ 650.716009] binder: BINDER_SET_CONTEXT_MGR already set [ 650.722335] binder: BINDER_SET_CONTEXT_MGR already set [ 650.722978] binder: 6084:6085 ioctl c0306201 0 returned -14 [ 650.727844] binder: 6080:6081 ioctl 40046207 0 returned -16 19:26:10 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 650.743942] binder: 6079:6082 ioctl 40046207 0 returned -16 [ 650.743945] binder: BINDER_SET_CONTEXT_MGR already set [ 650.743994] binder: 6084:6085 ioctl 40046207 0 returned -16 [ 650.769331] binder: release 6079:6082 transaction 4676 out, still active [ 650.781402] binder: undelivered TRANSACTION_COMPLETE [ 650.824478] binder: 6092:6093 ioctl c0306201 0 returned -14 [ 650.832746] binder: BINDER_SET_CONTEXT_MGR already set [ 650.838165] binder: 6092:6093 ioctl 40046207 0 returned -16 [ 650.856373] binder: 6092:6093 ioctl c0306201 0 returned -14 [ 650.863299] binder: release 6092:6093 transaction 4683 out, still active 19:26:10 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 650.874632] binder: undelivered TRANSACTION_COMPLETE [ 650.910901] binder: 6096:6097 ioctl c0306201 0 returned -14 [ 650.917572] binder: BINDER_SET_CONTEXT_MGR already set [ 650.923337] binder: 6096:6097 ioctl 40046207 0 returned -16 [ 650.943262] binder: 6096:6097 ioctl c0306201 0 returned -14 [ 650.945839] binder: release 6063:6064 transaction 4669 out, still active 19:26:10 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:10 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 650.962516] binder: unexpected work type, 4, not freed [ 650.994582] binder: undelivered TRANSACTION_COMPLETE [ 651.005485] binder: release 6096:6097 transaction 4684 out, still active [ 651.015817] binder: undelivered TRANSACTION_COMPLETE [ 651.024649] binder: 6103:6104 ioctl c0306201 0 returned -14 [ 651.038044] binder: 6101:6102 ioctl c0306201 0 returned -14 [ 651.047901] binder: BINDER_SET_CONTEXT_MGR already set [ 651.053944] binder: 6103:6104 ioctl 40046207 0 returned -16 [ 651.057748] binder: BINDER_SET_CONTEXT_MGR already set [ 651.066541] binder: 6101:6102 ioctl 40046207 0 returned -16 [ 651.078292] binder: 6103:6104 ioctl c0306201 0 returned -14 [ 651.085919] binder: release 6103:6104 transaction 4685 out, still active [ 651.093181] binder: undelivered TRANSACTION_COMPLETE 19:26:10 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) 19:26:10 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) [ 651.122182] binder: 6107:6108 ioctl c0306201 0 returned -14 [ 651.128788] binder: BINDER_SET_CONTEXT_MGR already set [ 651.137305] binder: 6107:6108 ioctl 40046207 0 returned -16 [ 651.159543] binder: release 6107:6108 transaction 4689 out, still active [ 651.166378] binder: undelivered TRANSACTION_COMPLETE 19:26:10 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) [ 651.202711] binder: 6113:6114 ioctl c0306201 0 returned -14 [ 651.209543] binder: BINDER_SET_CONTEXT_MGR already set [ 651.215372] binder: 6113:6114 ioctl 40046207 0 returned -16 19:26:10 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 651.267833] binder: unexpected work type, 4, not freed [ 651.298147] binder: 6117:6118 ioctl c0306201 0 returned -14 [ 651.306105] binder: BINDER_SET_CONTEXT_MGR already set [ 651.314321] binder: 6117:6118 ioctl 40046207 0 returned -16 [ 651.326336] binder: BINDER_SET_CONTEXT_MGR already set [ 651.337586] binder: 6120:6121 ioctl 40046207 0 returned -16 19:26:10 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 651.414244] binder: 6125:6127 ioctl c0306201 0 returned -14 [ 651.426735] binder: BINDER_SET_CONTEXT_MGR already set [ 651.432497] binder: 6125:6127 ioctl 40046207 0 returned -16 [ 651.446473] binder_thread_write: 6 callbacks suppressed [ 651.446490] binder: 6125:6127 BC_ACQUIRE_DONE node 4693 has no pending acquire request 19:26:10 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:10 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, &(0x7f00000007c0)}) 19:26:10 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:10 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 651.479212] binder: unexpected work type, 4, not freed [ 651.497329] binder: unexpected work type, 4, not freed [ 651.546112] binder: BINDER_SET_CONTEXT_MGR already set [ 651.555853] binder: 6132:6133 ioctl c0306201 0 returned -14 19:26:10 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 651.587433] binder: 6134:6136 ioctl c0306201 0 returned -14 [ 651.589376] binder: 6130:6131 ioctl 40046207 0 returned -16 [ 651.599790] binder: 6135:6137 ioctl c0306201 0 returned -14 [ 651.604584] binder: BINDER_SET_CONTEXT_MGR already set [ 651.619546] binder: 6132:6133 ioctl 40046207 0 returned -16 [ 651.625804] binder: BINDER_SET_CONTEXT_MGR already set [ 651.635223] binder: BINDER_SET_CONTEXT_MGR already set [ 651.635396] binder: 6135:6137 ioctl 40046207 0 returned -16 [ 651.652161] binder: 6134:6136 ioctl 40046207 0 returned -16 [ 651.690724] binder: BINDER_SET_CONTEXT_MGR already set [ 651.696327] binder: 6142:6144 ioctl 40046207 0 returned -16 [ 651.704700] binder: 6135:6145 BC_ACQUIRE_DONE node 4697 has no pending acquire request [ 651.718995] binder: 6134:6148 BC_ACQUIRE_DONE node 4700 has no pending acquire request 19:26:11 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) 19:26:11 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, &(0x7f00000007c0)}) 19:26:11 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:11 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 651.805302] binder: unexpected work type, 4, not freed [ 651.843389] binder: 6153:6155 ioctl c0306201 0 returned -14 [ 651.858988] binder: 6154:6157 ioctl c0306201 0 returned -14 [ 651.869097] binder: BINDER_SET_CONTEXT_MGR already set [ 651.876142] binder: BINDER_SET_CONTEXT_MGR already set [ 651.882165] binder: 6154:6157 ioctl 40046207 0 returned -16 [ 651.888197] binder: 6153:6155 ioctl 40046207 0 returned -16 19:26:11 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, &(0x7f00000007c0)}) [ 651.888666] binder: 6158:6160 ioctl c0306201 0 returned -14 [ 651.913601] binder: 6159:6161 ioctl c0306201 0 returned -14 [ 651.933600] binder: BINDER_SET_CONTEXT_MGR already set 19:26:11 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 651.943764] binder: 6154:6166 BC_ACQUIRE_DONE node 4703 has no pending acquire request [ 651.945360] binder: 6158:6164 ioctl 40046207 0 returned -16 [ 651.957856] binder: BINDER_SET_CONTEXT_MGR already set [ 651.968688] binder: 6165:6168 ioctl c0306201 0 returned -14 [ 651.971729] binder: 6159:6161 ioctl 40046207 0 returned -16 [ 651.985700] binder: BINDER_SET_CONTEXT_MGR already set [ 652.017307] binder: 6165:6168 ioctl 40046207 0 returned -16 [ 652.073765] binder: 6174:6175 ioctl c0306201 0 returned -14 [ 652.090525] binder: BINDER_SET_CONTEXT_MGR already set [ 652.103476] binder: 6174:6175 ioctl 40046207 0 returned -16 19:26:11 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 652.170898] binder: 6174:6180 BC_ACQUIRE_DONE node 4712 has no pending acquire request [ 652.201388] binder: unexpected work type, 4, not freed [ 652.234278] binder: 6182:6183 ioctl c0306201 0 returned -14 [ 652.242155] binder: BINDER_SET_CONTEXT_MGR already set [ 652.247608] binder: 6182:6183 ioctl 40046207 0 returned -16 [ 652.263039] binder: 6182:6183 BC_ACQUIRE_DONE node 4715 has no pending acquire request 19:26:11 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:11 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:11 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 19:26:11 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 652.363759] binder: unexpected work type, 4, not freed [ 652.405818] binder: 6187:6190 ioctl c0306201 0 returned -14 [ 652.407201] binder: 6189:6192 ioctl c0306201 0 returned -14 [ 652.419040] binder: 6184:6191 ioctl c0306201 0 returned -14 [ 652.428591] binder: BINDER_SET_CONTEXT_MGR already set [ 652.428633] binder: 6185:6186 ioctl c0306201 0 returned -14 [ 652.438542] binder: 6184:6191 ioctl 40046207 0 returned -16 [ 652.447888] binder: BINDER_SET_CONTEXT_MGR already set 19:26:11 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 652.455951] binder: 6187:6190 ioctl 40046207 0 returned -16 [ 652.457484] binder: BINDER_SET_CONTEXT_MGR already set [ 652.467757] binder: BINDER_SET_CONTEXT_MGR already set [ 652.469273] binder: 6189:6192 ioctl 40046207 0 returned -16 [ 652.477817] binder: 6185:6186 ioctl 40046207 0 returned -16 [ 652.497294] binder: 6187:6190 BC_ACQUIRE_DONE u0000000000000000 no match 19:26:11 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 19:26:11 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 652.519987] binder: 6189:6192 ioctl c0306201 0 returned -14 [ 652.528521] binder: 6198:6199 ioctl c0306201 0 returned -14 [ 652.535525] binder: BINDER_SET_CONTEXT_MGR already set [ 652.541660] binder: 6198:6199 ioctl 40046207 0 returned -16 [ 652.554542] binder: 6185:6200 BC_ACQUIRE_DONE node 4723 has no pending acquire request [ 652.560287] binder: 6198:6199 BC_ACQUIRE_DONE u0000000000000000 no match [ 652.603607] binder: 6204:6205 ioctl c0306201 0 returned -14 [ 652.617550] binder: BINDER_SET_CONTEXT_MGR already set [ 652.621816] binder: 6207:6208 ioctl c0306201 0 returned -14 [ 652.627411] binder: 6204:6205 ioctl 40046207 0 returned -16 19:26:12 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 652.650496] binder: 6204:6205 BC_ACQUIRE_DONE u0000000000000000 no match [ 652.655289] binder: BINDER_SET_CONTEXT_MGR already set [ 652.694735] binder: 6207:6208 ioctl 40046207 0 returned -16 [ 652.726925] binder: 6211:6213 ioctl c0306201 0 returned -14 [ 652.734313] binder: 6207:6208 ioctl c0306201 0 returned -14 19:26:12 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 652.741882] binder: BINDER_SET_CONTEXT_MGR already set [ 652.747505] binder: 6211:6213 ioctl 40046207 0 returned -16 [ 652.794530] binder: 6216:6217 ioctl c0306201 0 returned -14 [ 652.809050] binder: BINDER_SET_CONTEXT_MGR already set [ 652.814756] binder: 6216:6217 ioctl 40046207 0 returned -16 [ 652.825566] binder: 6211:6218 BC_ACQUIRE_DONE node 4729 has no pending acquire request 19:26:12 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(0x0) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 652.843635] binder: 6216:6217 BC_ACQUIRE_DONE node 4732 has no pending acquire request [ 652.859285] binder: unexpected work type, 4, not freed [ 652.886632] binder: 6220:6222 ioctl c0306201 0 returned -14 [ 652.894505] binder: BINDER_SET_CONTEXT_MGR already set [ 652.900763] binder: 6220:6222 ioctl 40046207 0 returned -16 [ 652.954879] binder: 6220:6223 BC_ACQUIRE_DONE node 4735 has no pending acquire request 19:26:12 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 653.023330] binder: unexpected work type, 4, not freed [ 653.048486] binder: 6225:6226 ioctl c0306201 0 returned -14 [ 653.055406] binder: BINDER_SET_CONTEXT_MGR already set [ 653.064617] binder: 6225:6226 ioctl 40046207 0 returned -16 19:26:12 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:12 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 653.192165] binder: unexpected work type, 4, not freed [ 653.199692] binder: unexpected work type, 4, not freed [ 653.258084] binder: 6228:6230 ioctl c0306201 0 returned -14 [ 653.276445] binder: BINDER_SET_CONTEXT_MGR already set [ 653.282103] binder: 6228:6230 ioctl 40046207 0 returned -16 [ 653.292630] binder: 6231:6232 ioctl c0306201 0 returned -14 [ 653.312509] binder: BINDER_SET_CONTEXT_MGR already set [ 653.317824] binder: 6231:6232 ioctl 40046207 0 returned -16 19:26:12 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 653.494438] binder: unexpected work type, 4, not freed 19:26:12 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 19:26:13 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(0x0) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 653.675441] binder: 6240:6241 ioctl c0306201 0 returned -14 [ 653.682413] binder: unexpected work type, 4, not freed [ 653.698743] binder: BINDER_SET_CONTEXT_MGR already set [ 653.715899] binder: 6240:6241 ioctl 40046207 0 returned -16 19:26:13 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 653.776298] binder: 6240:6241 ioctl c0306201 0 returned -14 19:26:13 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 653.842872] binder: 6245:6246 ioctl c0306201 0 returned -14 [ 653.859248] binder: unexpected work type, 4, not freed [ 653.880746] binder: BINDER_SET_CONTEXT_MGR already set [ 653.886204] binder: 6245:6246 ioctl 40046207 0 returned -16 [ 653.892675] binder: 6247:6248 ioctl c0306201 0 returned -14 [ 653.915948] binder: BINDER_SET_CONTEXT_MGR already set [ 653.927082] binder: 6247:6248 ioctl 40046207 0 returned -16 [ 653.953303] binder: 6249:6250 ioctl c0306201 0 returned -14 19:26:13 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 653.970457] binder: BINDER_SET_CONTEXT_MGR already set [ 653.988355] binder: 6249:6250 ioctl 40046207 0 returned -16 19:26:13 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 654.049175] binder: unexpected work type, 4, not freed [ 654.061724] binder: 6255:6256 ioctl c0306201 0 returned -14 19:26:13 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 654.089602] binder: unexpected work type, 4, not freed [ 654.122950] binder: 6259:6261 ioctl c0306201 0 returned -14 [ 654.128873] binder: BINDER_SET_CONTEXT_MGR already set [ 654.147226] binder: 6255:6262 ioctl 40046207 0 returned -16 [ 654.153448] binder: BINDER_SET_CONTEXT_MGR already set [ 654.163556] binder: 6259:6261 ioctl 40046207 0 returned -16 [ 654.175435] binder: 6263:6264 ioctl c0306201 0 returned -14 [ 654.202908] binder_thread_write: 37 callbacks suppressed [ 654.202939] binder: 6255:6256 Release 1 refcount change on invalid ref 1 ret -22 [ 654.204072] binder: BINDER_SET_CONTEXT_MGR already set [ 654.319241] binder: 6263:6264 ioctl 40046207 0 returned -16 [ 654.396850] binder: 6263:6267 Release 1 refcount change on invalid ref 1 ret -22 [ 654.536746] binder_release_work: 1 callbacks suppressed [ 654.536753] binder: undelivered TRANSACTION_ERROR: 29189 19:26:13 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(0x0) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 654.639151] binder: unexpected work type, 4, not freed 19:26:14 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 654.695331] binder: 6269:6271 ioctl c0306201 0 returned -14 [ 654.701642] binder: unexpected work type, 4, not freed [ 654.710473] binder: BINDER_SET_CONTEXT_MGR already set [ 654.715944] binder: 6269:6271 ioctl 40046207 0 returned -16 [ 654.728461] binder: undelivered TRANSACTION_ERROR: 29189 [ 654.770755] binder: 6269:6274 Release 1 refcount change on invalid ref 1 ret -22 [ 654.782201] binder: 6272:6273 ioctl c0306201 0 returned -14 [ 654.795433] binder: BINDER_SET_CONTEXT_MGR already set [ 654.810135] binder: 6272:6273 ioctl 40046207 0 returned -16 [ 654.817751] binder: unexpected work type, 4, not freed 19:26:14 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:14 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 654.929356] binder: unexpected work type, 4, not freed [ 654.932931] binder: 6278:6279 ioctl c0306201 0 returned -14 [ 654.960235] binder: unexpected work type, 4, not freed [ 654.967677] binder: BINDER_SET_CONTEXT_MGR already set [ 654.999306] binder: 6278:6279 ioctl 40046207 0 returned -16 [ 655.046736] binder: 6282:6283 ioctl c0306201 0 returned -14 [ 655.063811] binder: BINDER_SET_CONTEXT_MGR already set [ 655.076798] binder: 6282:6283 ioctl 40046207 0 returned -16 [ 655.295402] device bridge_slave_1 left promiscuous mode [ 655.303411] bridge0: port 2(bridge_slave_1) entered disabled state [ 655.373836] device bridge_slave_0 left promiscuous mode [ 655.381792] bridge0: port 1(bridge_slave_0) entered disabled state [ 655.481224] binder_thread_release: 37 callbacks suppressed [ 655.481232] binder: release 6269:6271 transaction 4763 out, still active [ 655.493961] binder: unexpected work type, 4, not freed [ 655.501135] binder_release_work: 36 callbacks suppressed [ 655.501139] binder: undelivered TRANSACTION_COMPLETE [ 655.524930] device hsr_slave_1 left promiscuous mode [ 655.557805] binder: release 6272:6273 transaction 4766 out, still active [ 655.564818] binder: unexpected work type, 4, not freed [ 655.570469] binder: undelivered TRANSACTION_COMPLETE [ 655.585882] device hsr_slave_0 left promiscuous mode [ 655.624850] team0 (unregistering): Port device team_slave_1 removed [ 655.635570] team0 (unregistering): Port device team_slave_0 removed [ 655.646736] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 655.673075] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 655.703586] binder: release 6278:6279 transaction 4769 out, still active [ 655.710906] binder: unexpected work type, 4, not freed [ 655.716242] binder: undelivered TRANSACTION_COMPLETE [ 655.767629] bond0 (unregistering): Released all slaves [ 655.852613] binder: release 6282:6283 transaction 4772 out, still active [ 655.859643] binder: unexpected work type, 4, not freed [ 655.864922] binder: undelivered TRANSACTION_COMPLETE [ 656.492205] IPVS: ftp: loaded support on port[0] = 21 [ 656.606346] chnl_net:caif_netlink_parms(): no params data found [ 656.655745] bridge0: port 1(bridge_slave_0) entered blocking state [ 656.667545] bridge0: port 1(bridge_slave_0) entered disabled state [ 656.675891] device bridge_slave_0 entered promiscuous mode [ 656.687952] bridge0: port 2(bridge_slave_1) entered blocking state [ 656.696440] bridge0: port 2(bridge_slave_1) entered disabled state [ 656.708034] device bridge_slave_1 entered promiscuous mode [ 656.733293] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 656.743115] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 656.763193] team0: Port device team_slave_0 added [ 656.769852] team0: Port device team_slave_1 added [ 656.821768] device hsr_slave_0 entered promiscuous mode [ 656.879522] device hsr_slave_1 entered promiscuous mode [ 656.951171] 8021q: adding VLAN 0 to HW filter on device bond0 [ 656.961562] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 656.968499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 656.981350] 8021q: adding VLAN 0 to HW filter on device team0 [ 656.988979] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 656.997031] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 657.005014] bridge0: port 1(bridge_slave_0) entered blocking state [ 657.011419] bridge0: port 1(bridge_slave_0) entered forwarding state [ 657.018926] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 657.030374] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 657.038134] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 657.046421] bridge0: port 2(bridge_slave_1) entered blocking state [ 657.052892] bridge0: port 2(bridge_slave_1) entered forwarding state [ 657.060065] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 657.079624] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 657.087666] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 657.096354] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 657.104266] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 657.112723] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 657.120482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 657.127836] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 657.136397] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 657.143382] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 657.151149] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 657.160033] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 657.183403] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 657.253768] binder: 6294:6295 ioctl c0306201 0 returned -14 [ 657.262786] binder: BINDER_SET_CONTEXT_MGR already set [ 657.268092] binder: 6294:6295 ioctl 40046207 0 returned -16 [ 657.283369] binder: 6294:6295 Release 1 refcount change on invalid ref 1 ret -22 [ 657.301098] binder_thread_write: 9 callbacks suppressed [ 657.301116] binder: 6294:6295 BC_ACQUIRE_DONE node 4776 has no pending acquire request 19:26:17 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:17 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:17 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:17 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:17 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(0x0) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:17 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 658.050860] binder: release 6294:6295 transaction 4775 out, still active [ 658.094791] binder: 6301:6303 ioctl c0306201 0 returned -14 [ 658.101212] binder: 6297:6304 ioctl c0306201 0 returned -14 [ 658.110189] binder: 6299:6300 ioctl c0306201 0 returned -14 [ 658.121316] binder: 6296:6298 ioctl c0306201 0 returned -14 [ 658.127213] binder: BINDER_SET_CONTEXT_MGR already set [ 658.134825] binder: 6302:6306 ioctl 40046207 0 returned -16 [ 658.141553] binder: BINDER_SET_CONTEXT_MGR already set [ 658.152359] binder: BINDER_SET_CONTEXT_MGR already set [ 658.157920] binder: BINDER_SET_CONTEXT_MGR already set [ 658.163929] binder: 6307:6308 ioctl c0306201 0 returned -14 [ 658.165270] binder: 6301:6303 ioctl 40046207 0 returned -16 [ 658.172855] binder: 6302:6309 Release 1 refcount change on invalid ref 1 ret -22 [ 658.187479] binder: 6299:6300 ioctl 40046207 0 returned -16 19:26:17 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 658.194146] binder: 6296:6298 ioctl 40046207 0 returned -16 [ 658.200243] binder: BINDER_SET_CONTEXT_MGR already set [ 658.211036] binder: 6297:6304 ioctl 40046207 0 returned -16 [ 658.217200] binder: BINDER_SET_CONTEXT_MGR already set [ 658.227715] binder: 6299:6300 Release 1 refcount change on invalid ref 1 ret -22 [ 658.227770] binder: 6297:6311 Release 1 refcount change on invalid ref 1 ret -22 19:26:17 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 658.244327] binder: 6307:6308 ioctl 40046207 0 returned -16 [ 658.245014] binder: 6307:6316 Release 1 refcount change on invalid ref 1 ret -22 19:26:17 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 658.293533] binder: BINDER_SET_CONTEXT_MGR already set [ 658.306173] binder: 6318:6319 ioctl 40046207 0 returned -16 [ 658.316019] binder: release 6297:6311 transaction 4779 out, still active [ 658.336061] binder: 6318:6319 Release 1 refcount change on invalid ref 1 ret -22 19:26:17 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 658.349047] binder: 6307:6308 BC_ACQUIRE_DONE node 4791 has no pending acquire request [ 658.355889] binder: 6323:6324 ioctl c0306201 0 returned -14 [ 658.388571] binder: BINDER_SET_CONTEXT_MGR already set [ 658.390851] binder: 6326:6327 ioctl c0306201 0 returned -14 [ 658.402426] binder: 6323:6324 ioctl 40046207 0 returned -16 [ 658.411911] binder: BINDER_SET_CONTEXT_MGR already set [ 658.434772] binder: 6326:6327 ioctl 40046207 0 returned -16 [ 658.438445] binder: 6323:6324 Release 1 refcount change on invalid ref 1 ret -22 19:26:17 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:17 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 658.440665] binder: BINDER_SET_CONTEXT_MGR already set [ 658.455990] binder: 6330:6331 ioctl 40046207 0 returned -16 19:26:17 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 658.508835] binder: 6326:6336 BC_ACQUIRE_DONE node 4795 has no pending acquire request [ 658.536342] binder: 6335:6339 ioctl c0306201 0 returned -14 [ 658.552339] binder: BINDER_SET_CONTEXT_MGR already set [ 658.558853] binder: 6335:6339 ioctl 40046207 0 returned -16 [ 658.573889] binder: 6340:6342 ioctl c0306201 0 returned -14 [ 658.590356] binder: BINDER_SET_CONTEXT_MGR already set [ 658.595912] binder: 6340:6342 ioctl 40046207 0 returned -16 [ 658.618109] binder: 6335:6339 BC_ACQUIRE_DONE u0000000000000000 no match [ 658.633196] binder: 6343:6344 ioctl c0306201 0 returned -14 [ 658.639815] binder: BINDER_SET_CONTEXT_MGR already set [ 658.645119] binder: 6343:6344 ioctl 40046207 0 returned -16 [ 658.657329] binder: 6340:6346 BC_ACQUIRE_DONE node 4799 has no pending acquire request [ 658.704581] binder: 6343:6348 BC_ACQUIRE_DONE node 4802 has no pending acquire request [ 658.879542] binder: release 6296:6312 transaction 4780 out, still active [ 658.898133] binder: release 6301:6303 transaction 4783 out, still active [ 658.916566] binder: unexpected work type, 4, not freed [ 658.927070] binder: undelivered TRANSACTION_COMPLETE 19:26:18 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:18 executing program 1: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r0, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:18 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 658.956205] binder: release 6307:6316 transaction 4790 out, still active [ 658.984754] binder: unexpected work type, 4, not freed [ 658.992657] binder: undelivered TRANSACTION_COMPLETE [ 658.998524] binder: 6351:6355 ioctl c0306201 0 returned -14 [ 659.003187] binder: 6353:6354 ioctl c0306201 0 returned -14 [ 659.006306] binder: 6356:6357 ioctl c0306201 0 returned -14 [ 659.017688] binder: BINDER_SET_CONTEXT_MGR already set [ 659.028724] binder: BINDER_SET_CONTEXT_MGR already set [ 659.030637] binder: 6353:6354 ioctl 40046207 0 returned -16 [ 659.040245] binder: 6351:6355 ioctl 40046207 0 returned -16 [ 659.046259] binder: BINDER_SET_CONTEXT_MGR already set 19:26:18 executing program 1: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r0, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 659.054445] binder: 6356:6357 ioctl 40046207 0 returned -16 [ 659.112535] binder: 6351:6360 ioctl c0306201 0 returned -14 [ 659.122032] binder: 6356:6364 BC_ACQUIRE_DONE node 4811 has no pending acquire request [ 659.122604] binder: 6361:6362 ioctl c0306201 0 returned -14 [ 659.131088] binder: 6351:6360 BC_ACQUIRE_DONE node 4808 has no pending acquire request [ 659.144740] binder: BINDER_SET_CONTEXT_MGR already set [ 659.153106] binder: 6361:6362 ioctl 40046207 0 returned -16 19:26:18 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 659.304244] binder: release 6335:6339 transaction 4797 out, still active 19:26:18 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 659.365482] binder: unexpected work type, 4, not freed [ 659.395316] binder: undelivered TRANSACTION_COMPLETE 19:26:18 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 659.420235] binder: unexpected work type, 4, not freed [ 659.443800] binder: 6371:6372 ioctl c0306201 0 returned -14 [ 659.444291] binder: undelivered TRANSACTION_COMPLETE [ 659.486147] binder: BINDER_SET_CONTEXT_MGR already set [ 659.497417] binder: 6374:6375 ioctl c0306201 0 returned -14 [ 659.509390] binder: 6371:6372 ioctl 40046207 0 returned -16 [ 659.511218] binder: BINDER_SET_CONTEXT_MGR already set [ 659.525007] binder: 6374:6375 ioctl 40046207 0 returned -16 [ 659.583263] binder_thread_write: 6 callbacks suppressed [ 659.583278] binder: 6374:6384 Release 1 refcount change on invalid ref 1 ret -22 19:26:19 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 659.630177] binder: 6374:6426 BC_ACQUIRE_DONE node 4820 has no pending acquire request [ 659.652922] binder: 6371:6428 Release 1 refcount change on invalid ref 1 ret -22 [ 659.697034] binder: 6371:6428 BC_ACQUIRE_DONE node 4817 has no pending acquire request 19:26:19 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 659.771649] binder: undelivered TRANSACTION_COMPLETE [ 659.776890] binder: undelivered TRANSACTION_ERROR: 29189 [ 659.798806] binder: unexpected work type, 4, not freed 19:26:19 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 659.837539] binder: undelivered TRANSACTION_COMPLETE [ 659.890565] binder: undelivered TRANSACTION_ERROR: 29189 [ 659.896575] binder: unexpected work type, 4, not freed 19:26:19 executing program 1: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r0, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 659.930729] binder: 6431:6432 ioctl c0306201 0 returned -14 [ 659.946820] binder: 6435:6436 ioctl c0306201 0 returned -14 [ 659.955333] binder: unexpected work type, 4, not freed [ 659.971457] binder: BINDER_SET_CONTEXT_MGR already set [ 660.007959] binder: BINDER_SET_CONTEXT_MGR already set [ 660.014593] binder: 6431:6438 ioctl 40046207 0 returned -16 [ 660.026444] binder: 6435:6439 ioctl 40046207 0 returned -16 [ 660.059539] binder: 6434:6437 ioctl c0306201 0 returned -14 [ 660.077400] binder: 6431:6442 Release 1 refcount change on invalid ref 1 ret -22 [ 660.105064] binder: 6441:6443 ioctl c0306201 0 returned -14 [ 660.130457] binder: 6435:6439 ioctl c0306201 0 returned -14 [ 660.132305] binder: BINDER_SET_CONTEXT_MGR already set [ 660.140358] binder: 6435:6439 BC_ACQUIRE_DONE node 4826 has no pending acquire request [ 660.207864] binder: 6434:6437 ioctl 40046207 0 returned -16 [ 660.208919] binder: BINDER_SET_CONTEXT_MGR already set [ 660.223750] binder: 6441:6444 ioctl 40046207 0 returned -16 [ 660.228923] binder: unexpected work type, 4, not freed [ 660.239693] binder: 6434:6445 Release 1 refcount change on invalid ref 1 ret -22 19:26:19 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 660.399465] binder: 6434:6437 BC_ACQUIRE_DONE u0000000000000000 no match 19:26:19 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 660.447908] binder: 6449:6451 ioctl c0306201 0 returned -14 [ 660.493688] binder: BINDER_SET_CONTEXT_MGR already set [ 660.499011] binder: 6449:6453 ioctl 40046207 0 returned -16 [ 660.576907] binder_thread_release: 7 callbacks suppressed [ 660.576918] binder: release 6299:6310 transaction 4778 out, still active [ 660.596403] binder: 6449:6453 Release 1 refcount change on invalid ref 1 ret -22 [ 660.614698] binder: release 6431:6432 transaction 4822 out, still active 19:26:20 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 660.634364] binder: unexpected work type, 4, not freed [ 660.642375] binder_release_work: 5 callbacks suppressed [ 660.642379] binder: undelivered TRANSACTION_COMPLETE [ 660.654407] binder: 6454:6455 ioctl c0306201 0 returned -14 [ 660.671762] binder: BINDER_SET_CONTEXT_MGR already set [ 660.696281] binder: 6458:6459 ioctl c0306201 0 returned -14 [ 660.701176] binder: 6454:6455 ioctl 40046207 0 returned -16 [ 660.702467] binder: release 6323:6324 transaction 4793 out, still active [ 660.718852] binder: BINDER_SET_CONTEXT_MGR already set [ 660.722154] binder: 6454:6455 Release 1 refcount change on invalid ref 1 ret -22 [ 660.732295] binder: undelivered TRANSACTION_COMPLETE [ 660.737592] binder: 6458:6459 ioctl 40046207 0 returned -16 19:26:20 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 660.744159] binder: release 6435:6436 transaction 4825 out, still active [ 660.755423] binder: unexpected work type, 4, not freed [ 660.762594] binder: undelivered TRANSACTION_COMPLETE [ 660.798662] binder: 6454:6455 BC_ACQUIRE_DONE u0000000000000000 no match [ 660.806006] binder: 6458:6461 Release 1 refcount change on invalid ref 1 ret -22 [ 660.829044] binder: 6462:6463 ioctl c0306201 0 returned -14 [ 660.838509] binder: BINDER_SET_CONTEXT_MGR already set [ 660.848565] binder: 6462:6463 ioctl 40046207 0 returned -16 19:26:20 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 660.898019] binder: release 6441:6443 transaction 4828 out, still active [ 660.912888] binder: 6462:6466 ioctl c0306201 0 returned -14 [ 660.939539] binder: unexpected work type, 4, not freed [ 660.944840] binder: undelivered TRANSACTION_COMPLETE [ 660.956563] binder: release 5601:5602 transaction 4481 out, still active [ 660.973952] binder: undelivered TRANSACTION_COMPLETE [ 660.974881] binder: 6467:6468 ioctl c0306201 0 returned -14 [ 661.013109] binder: BINDER_SET_CONTEXT_MGR already set [ 661.018736] binder: 6467:6468 ioctl 40046207 0 returned -16 [ 661.189207] binder: release 6449:6451 transaction 4832 out, still active [ 661.196191] binder: unexpected work type, 4, not freed [ 661.215129] binder: undelivered TRANSACTION_COMPLETE [ 661.346732] binder: release 6454:6455 transaction 4835 out, still active [ 661.468491] device bridge_slave_1 left promiscuous mode [ 661.474782] bridge0: port 2(bridge_slave_1) entered disabled state [ 661.484826] binder: release 6458:6459 transaction 4836 out, still active [ 661.498192] binder: unexpected work type, 4, not freed [ 661.521072] binder: undelivered TRANSACTION_COMPLETE [ 661.559936] device bridge_slave_0 left promiscuous mode [ 661.565371] bridge0: port 1(bridge_slave_0) entered disabled state [ 661.620030] binder: release 6462:6463 transaction 4839 out, still active [ 661.627771] binder: unexpected work type, 4, not freed [ 661.634349] binder: undelivered TRANSACTION_COMPLETE [ 661.661008] device hsr_slave_1 left promiscuous mode [ 661.722400] device hsr_slave_0 left promiscuous mode [ 661.728773] binder: unexpected work type, 4, not freed [ 661.734224] binder: undelivered TRANSACTION_COMPLETE [ 661.764857] team0 (unregistering): Port device team_slave_1 removed [ 661.774455] team0 (unregistering): Port device team_slave_0 removed [ 661.786058] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 661.852946] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 661.919490] bond0 (unregistering): Released all slaves [ 662.630504] IPVS: ftp: loaded support on port[0] = 21 [ 662.723277] chnl_net:caif_netlink_parms(): no params data found [ 662.758336] bridge0: port 1(bridge_slave_0) entered blocking state [ 662.766189] bridge0: port 1(bridge_slave_0) entered disabled state [ 662.773606] device bridge_slave_0 entered promiscuous mode [ 662.781145] bridge0: port 2(bridge_slave_1) entered blocking state [ 662.787541] bridge0: port 2(bridge_slave_1) entered disabled state [ 662.794915] device bridge_slave_1 entered promiscuous mode [ 662.814776] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 662.824845] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 662.843974] team0: Port device team_slave_0 added [ 662.855739] team0: Port device team_slave_1 added [ 662.911187] device hsr_slave_0 entered promiscuous mode [ 662.949378] device hsr_slave_1 entered promiscuous mode [ 663.017953] bridge0: port 2(bridge_slave_1) entered blocking state [ 663.024351] bridge0: port 2(bridge_slave_1) entered forwarding state [ 663.031001] bridge0: port 1(bridge_slave_0) entered blocking state [ 663.037346] bridge0: port 1(bridge_slave_0) entered forwarding state [ 663.046211] bridge0: port 1(bridge_slave_0) entered disabled state [ 663.053559] bridge0: port 2(bridge_slave_1) entered disabled state [ 663.108557] 8021q: adding VLAN 0 to HW filter on device bond0 [ 663.126827] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 663.134241] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 663.148718] 8021q: adding VLAN 0 to HW filter on device team0 [ 663.169783] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 663.177498] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 663.185113] bridge0: port 1(bridge_slave_0) entered blocking state [ 663.191476] bridge0: port 1(bridge_slave_0) entered forwarding state [ 663.198297] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 663.206180] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 663.213752] bridge0: port 2(bridge_slave_1) entered blocking state [ 663.220113] bridge0: port 2(bridge_slave_1) entered forwarding state [ 663.226827] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 663.234578] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 663.242174] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 663.249873] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 663.257354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 663.265060] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 663.272517] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 663.280177] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 663.287454] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 663.294912] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 663.302423] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 663.310680] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 663.328463] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 663.411035] binder: 6479:6480 ioctl c0306201 0 returned -14 [ 663.424534] binder: BINDER_SET_CONTEXT_MGR already set [ 663.430237] binder: 6479:6480 ioctl 40046207 0 returned -16 19:26:23 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:23 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:23 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:23 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:23 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:23 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 664.198679] binder: 6485:6488 ioctl c0306201 0 returned -14 [ 664.199757] binder: 6487:6491 ioctl c0306201 0 returned -14 [ 664.239761] binder: BINDER_SET_CONTEXT_MGR already set [ 664.251099] binder: 6486:6492 ioctl c0306201 0 returned -14 [ 664.255515] binder: 6483:6484 ioctl 40046207 0 returned -16 [ 664.258497] binder: 6489:6490 ioctl c0306201 0 returned -14 [ 664.263843] binder: BINDER_SET_CONTEXT_MGR already set [ 664.275277] binder: BINDER_SET_CONTEXT_MGR already set [ 664.286566] binder: 6487:6496 ioctl 40046207 0 returned -16 [ 664.289245] binder: 6494:6495 ioctl c0306201 0 returned -14 [ 664.297682] binder: 6486:6492 ioctl 40046207 0 returned -16 [ 664.303988] binder: BINDER_SET_CONTEXT_MGR already set [ 664.310264] binder: 6489:6490 ioctl 40046207 0 returned -16 [ 664.314437] binder: BINDER_SET_CONTEXT_MGR already set [ 664.321692] binder: BINDER_SET_CONTEXT_MGR already set [ 664.332377] binder: 6494:6495 ioctl 40046207 0 returned -16 19:26:23 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 664.337290] binder: 6485:6497 ioctl 40046207 0 returned -16 [ 664.347804] binder: 6494:6495 Release 1 refcount change on invalid ref 1 ret -22 [ 664.347864] binder_thread_write: 4 callbacks suppressed [ 664.347887] binder: 6487:6496 BC_ACQUIRE_DONE node 4850 has no pending acquire request [ 664.363694] binder: 6489:6501 Release 1 refcount change on invalid ref 1 ret -22 [ 664.377019] binder: 6485:6502 Release 1 refcount change on invalid ref 1 ret -22 19:26:23 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:23 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 664.393477] binder: 6489:6501 BC_ACQUIRE_DONE node 4861 has no pending acquire request [ 664.406516] binder: 6485:6497 BC_ACQUIRE_DONE node 4859 has no pending acquire request [ 664.421599] binder: 6494:6495 BC_ACQUIRE_DONE u0000000000000000 no match [ 664.482178] binder: 6507:6508 ioctl c0306201 0 returned -14 [ 664.497810] binder: BINDER_SET_CONTEXT_MGR already set [ 664.504690] binder: 6507:6508 ioctl 40046207 0 returned -16 [ 664.510038] binder: 6512:6513 ioctl c0306201 0 returned -14 19:26:23 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 664.528283] binder: 6511:6514 ioctl c0306201 0 returned -14 [ 664.535514] binder: BINDER_SET_CONTEXT_MGR already set [ 664.538218] binder: 6507:6508 BC_ACQUIRE_DONE u0000000000000000 no match [ 664.541847] binder: 6512:6513 ioctl 40046207 0 returned -16 [ 664.554195] binder: BINDER_SET_CONTEXT_MGR already set [ 664.559842] binder: 6511:6514 ioctl 40046207 0 returned -16 [ 664.594862] binder: 6517:6518 ioctl c0306201 0 returned -14 [ 664.604414] binder: BINDER_SET_CONTEXT_MGR already set [ 664.610867] binder: 6517:6518 ioctl 40046207 0 returned -16 [ 664.616889] binder_thread_write: 1 callbacks suppressed [ 664.616901] binder: 6511:6519 Release 1 refcount change on invalid ref 1 ret -22 [ 664.622814] binder: 6512:6520 Release 1 refcount change on invalid ref 1 ret -22 [ 664.631770] binder: 6511:6519 BC_ACQUIRE_DONE node 4866 has no pending acquire request [ 664.645193] binder: 6512:6520 BC_ACQUIRE_DONE node 4869 has no pending acquire request [ 664.653256] binder: 6517:6518 Release 1 refcount change on invalid ref 1 ret -22 [ 664.676682] binder: 6517:6518 BC_ACQUIRE_DONE u0000000000000000 no match 19:26:24 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:24 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 664.990760] binder: unexpected work type, 4, not freed [ 664.996203] binder: undelivered TRANSACTION_COMPLETE [ 665.015485] binder: unexpected work type, 4, not freed [ 665.028662] binder: 6524:6525 ioctl c0306201 0 returned -14 19:26:24 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 665.047248] binder: BINDER_SET_CONTEXT_MGR already set [ 665.057624] binder: 6524:6525 ioctl 40046207 0 returned -16 [ 665.091841] binder: 6527:6528 ioctl c0306201 0 returned -14 [ 665.098647] binder: BINDER_SET_CONTEXT_MGR already set [ 665.107955] binder: 6527:6528 ioctl 40046207 0 returned -16 [ 665.131637] binder: 6524:6532 BC_ACQUIRE_DONE node 4873 has no pending acquire request [ 665.147539] binder: 6530:6531 ioctl c0306201 0 returned -14 [ 665.158223] binder: BINDER_SET_CONTEXT_MGR already set [ 665.168588] binder: 6530:6531 ioctl 40046207 0 returned -16 [ 665.182271] binder: 6530:6531 got transaction with invalid offset (0, min 0 max 24) or object. [ 665.191691] binder: 6530:6531 transaction failed 29201/-22, size 24-8 line 3097 [ 665.208073] binder: 6530:6531 Release 1 refcount change on invalid ref 1 ret -22 [ 665.224674] binder: 6530:6531 BC_ACQUIRE_DONE u0000000000000000 no match 19:26:24 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:24 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 665.292093] binder: unexpected work type, 4, not freed [ 665.302251] binder: unexpected work type, 4, not freed 19:26:24 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 665.401677] binder: undelivered TRANSACTION_ERROR: 29189 19:26:24 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 665.486347] binder: BINDER_SET_CONTEXT_MGR already set [ 665.495224] binder: 6640:6642 ioctl 40046207 0 returned -16 [ 665.550739] binder: unexpected work type, 4, not freed [ 665.567889] binder: unexpected work type, 4, not freed 19:26:24 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 665.595690] binder_thread_release: 13 callbacks suppressed [ 665.595698] binder: release 6021:6022 transaction 4649 out, still active [ 665.613715] binder: unexpected work type, 4, not freed [ 665.632325] binder: release 6154:6157 transaction 4702 out, still active [ 665.654312] binder: unexpected work type, 4, not freed [ 665.661418] binder_release_work: 8 callbacks suppressed [ 665.661422] binder: undelivered TRANSACTION_COMPLETE [ 665.679525] binder: release 5712:5713 transaction 4530 out, still active [ 665.702248] binder: BINDER_SET_CONTEXT_MGR already set [ 665.707800] binder: unexpected work type, 4, not freed [ 665.713582] binder: 6646:6647 ioctl 40046207 0 returned -16 [ 665.719768] binder: undelivered TRANSACTION_COMPLETE [ 665.725070] binder: release 6485:6488 transaction 4854 out, still active [ 665.732410] binder: unexpected work type, 4, not freed [ 665.737864] binder: undelivered TRANSACTION_COMPLETE [ 665.743364] binder: release 5923:5928 transaction 4618 out, still active [ 665.750498] binder: unexpected work type, 4, not freed [ 665.755931] binder: undelivered TRANSACTION_COMPLETE 19:26:25 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 19:26:25 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 665.797673] binder: release 6489:6490 transaction 4853 out, still active [ 665.807543] binder: unexpected work type, 4, not freed [ 665.833360] binder: undelivered TRANSACTION_COMPLETE 19:26:25 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 665.864927] binder: release 5926:5927 transaction 4615 out, still active [ 665.874416] binder: unexpected work type, 4, not freed [ 665.883860] binder: undelivered TRANSACTION_COMPLETE [ 665.884228] binder_alloc: 5550: binder_alloc_buf, no vma [ 665.889351] binder: release 6527:6528 transaction 4875 out, still active [ 665.904081] binder: unexpected work type, 4, not freed [ 665.933869] binder: 6651:6652 transaction failed 29189/-3, size 0-8 line 3035 [ 665.962230] binder: undelivered TRANSACTION_COMPLETE 19:26:25 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 665.982314] binder: 6653:6654 ioctl c0306201 0 returned -14 [ 665.994315] binder: release 6326:6327 transaction 4794 out, still active [ 665.999630] binder: 6656:6657 ioctl c0306201 0 returned -14 [ 666.011106] binder: BINDER_SET_CONTEXT_MGR already set [ 666.014453] binder: unexpected work type, 4, not freed [ 666.042944] binder: 6660:6661 ioctl c0306201 0 returned -14 [ 666.051260] binder: undelivered TRANSACTION_COMPLETE [ 666.059208] binder: BINDER_SET_CONTEXT_MGR already set [ 666.065640] binder: 6653:6658 ioctl 40046207 0 returned -16 [ 666.074232] binder: 6656:6657 ioctl 40046207 0 returned -16 [ 666.074379] binder_alloc: 5550: binder_alloc_buf, no vma [ 666.088500] binder: undelivered TRANSACTION_ERROR: 29189 [ 666.095205] binder: BINDER_SET_CONTEXT_MGR already set [ 666.110403] binder: 6653:6658 BC_ACQUIRE_DONE u0000000000000000 no match 19:26:25 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0), 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 666.138086] binder: 6656:6662 transaction failed 29189/-3, size 24-8 line 3035 [ 666.146722] binder: 6660:6661 ioctl 40046207 0 returned -16 [ 666.152777] binder: release 6524:6525 transaction 4872 out, still active [ 666.164863] binder: unexpected work type, 4, not freed [ 666.170676] binder_alloc: 5550: binder_alloc_buf, no vma [ 666.202281] binder: undelivered TRANSACTION_COMPLETE [ 666.211846] binder: 6667:6668 ioctl c0306201 0 returned -14 [ 666.220515] binder: 6653:6654 transaction failed 29189/-3, size 24-8 line 3035 [ 666.239025] binder_alloc: 5550: binder_alloc_buf, no vma [ 666.248437] binder: unexpected work type, 4, not freed [ 666.258586] binder: 6660:6661 transaction failed 29189/-3, size 24-8 line 3035 [ 666.278843] binder: BINDER_SET_CONTEXT_MGR already set [ 666.278982] binder: undelivered TRANSACTION_COMPLETE 19:26:25 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:25 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 666.307640] binder: 6660:6661 Release 1 refcount change on invalid ref 1 ret -22 [ 666.320739] binder: 6667:6669 ioctl 40046207 0 returned -16 [ 666.338945] binder: 6672:6673 ioctl c0306201 0 returned -14 [ 666.339652] binder: unexpected work type, 4, not freed [ 666.357324] binder_alloc: 5550: binder_alloc_buf, no vma [ 666.368306] binder: BINDER_SET_CONTEXT_MGR already set [ 666.380252] binder: 6660:6665 BC_ACQUIRE_DONE u0000000000000000 no match [ 666.384508] binder: 6667:6668 transaction failed 29189/-3, size 24-0 line 3035 [ 666.394837] binder: 6672:6673 ioctl 40046207 0 returned -16 [ 666.400830] binder: 6671:6674 ioctl c0306201 0 returned -14 [ 666.405764] binder: send failed reply for transaction 4459, target dead [ 666.416543] binder: send failed reply for transaction 4462, target dead [ 666.429750] binder_alloc: 6671: binder_alloc_buf, no vma [ 666.435078] binder: 6667:6669 Release 1 refcount change on invalid ref 1 ret -22 [ 666.439386] binder: 6671:6674 transaction failed 29189/-3, size 24-8 line 3035 [ 666.442865] binder_alloc: 6671: binder_alloc_buf, no vma [ 666.459852] binder: send failed reply for transaction 4465, target dead [ 666.466736] binder: 6672:6673 transaction failed 29189/-3, size 24-8 line 3035 [ 666.483418] binder: 6671:6675 BC_ACQUIRE_DONE u0000000000000000 no match [ 666.489476] binder: send failed reply for transaction 4468, target dead [ 666.522183] binder: send failed reply for transaction 4471, target dead [ 666.545796] binder: send failed reply for transaction 4472, target dead [ 666.565121] binder: send failed reply for transaction 4473, target dead [ 666.585910] binder: send failed reply for transaction 4476, target dead [ 666.612452] binder: send failed reply for transaction 4477, target dead [ 666.649703] binder: send failed reply for transaction 4480, target dead [ 666.656563] binder: send failed reply for transaction 4533 to 5717:5718 [ 666.671807] binder: send failed reply for transaction 4600 to 5876:5877 [ 666.678607] binder: send failed reply for transaction 4612 to 5910:5911 [ 666.687465] binder: send failed reply for transaction 4804 to 6353:6354 [ 666.698132] binder: send failed reply for transaction 4882 to 6646:6648 [ 666.708151] binder: undelivered TRANSACTION_ERROR: 29189 [ 666.717375] binder: undelivered TRANSACTION_ERROR: 29189 [ 666.732459] binder: undelivered TRANSACTION_ERROR: 29189 [ 667.079973] device bridge_slave_1 left promiscuous mode [ 667.085445] bridge0: port 2(bridge_slave_1) entered disabled state [ 667.149831] device bridge_slave_0 left promiscuous mode [ 667.155250] bridge0: port 1(bridge_slave_0) entered disabled state [ 667.262877] device hsr_slave_1 left promiscuous mode [ 667.352331] device hsr_slave_0 left promiscuous mode [ 667.404958] team0 (unregistering): Port device team_slave_1 removed [ 667.415584] team0 (unregistering): Port device team_slave_0 removed [ 667.425810] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 667.464242] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 667.552152] bond0 (unregistering): Released all slaves [ 667.730019] IPVS: ftp: loaded support on port[0] = 21 [ 667.856745] chnl_net:caif_netlink_parms(): no params data found [ 667.911705] bridge0: port 1(bridge_slave_0) entered blocking state [ 667.918119] bridge0: port 1(bridge_slave_0) entered disabled state [ 667.930797] device bridge_slave_0 entered promiscuous mode [ 667.937943] bridge0: port 2(bridge_slave_1) entered blocking state [ 667.948944] bridge0: port 2(bridge_slave_1) entered disabled state [ 667.964127] device bridge_slave_1 entered promiscuous mode [ 667.989045] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 668.003844] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 668.031278] team0: Port device team_slave_0 added [ 668.037517] team0: Port device team_slave_1 added [ 668.096943] IPVS: ftp: loaded support on port[0] = 21 [ 668.131575] device hsr_slave_0 entered promiscuous mode [ 668.189423] device hsr_slave_1 entered promiscuous mode [ 668.237016] bridge0: port 2(bridge_slave_1) entered blocking state [ 668.243407] bridge0: port 2(bridge_slave_1) entered forwarding state [ 668.250051] bridge0: port 1(bridge_slave_0) entered blocking state [ 668.256393] bridge0: port 1(bridge_slave_0) entered forwarding state [ 668.378947] 8021q: adding VLAN 0 to HW filter on device bond0 [ 668.387424] chnl_net:caif_netlink_parms(): no params data found [ 668.411235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 668.418739] bridge0: port 1(bridge_slave_0) entered disabled state [ 668.427596] bridge0: port 2(bridge_slave_1) entered disabled state [ 668.435670] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 668.456909] bridge0: port 1(bridge_slave_0) entered blocking state [ 668.469274] bridge0: port 1(bridge_slave_0) entered disabled state [ 668.476366] device bridge_slave_0 entered promiscuous mode [ 668.491248] 8021q: adding VLAN 0 to HW filter on device team0 [ 668.497649] bridge0: port 2(bridge_slave_1) entered blocking state [ 668.510381] bridge0: port 2(bridge_slave_1) entered disabled state [ 668.517473] device bridge_slave_1 entered promiscuous mode [ 668.550565] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 668.558157] bridge0: port 1(bridge_slave_0) entered blocking state [ 668.564545] bridge0: port 1(bridge_slave_0) entered forwarding state [ 668.578175] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 668.586436] bridge0: port 2(bridge_slave_1) entered blocking state [ 668.592823] bridge0: port 2(bridge_slave_1) entered forwarding state [ 668.607580] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 668.627875] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 668.647090] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 668.659006] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 668.676727] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 668.687915] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 668.695977] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 668.703563] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 668.711174] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 668.718443] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 668.746170] team0: Port device team_slave_0 added [ 668.754549] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 668.763251] team0: Port device team_slave_1 added [ 668.798271] device hsr_slave_0 entered promiscuous mode [ 668.869658] device hsr_slave_1 entered promiscuous mode [ 668.975613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 668.977574] binder: 6690:6691 ioctl c0306201 0 returned -14 [ 668.986836] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 668.995526] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 669.005391] 8021q: adding VLAN 0 to HW filter on device team0 [ 669.015074] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 669.017658] binder_alloc: 6690: binder_alloc_buf, no vma [ 669.023402] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 669.030827] binder: 6690:6691 transaction failed 29189/-3, size 24-8 line 3035 [ 669.035824] bridge0: port 1(bridge_slave_0) entered blocking state [ 669.049167] bridge0: port 1(bridge_slave_0) entered forwarding state 19:26:28 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:28 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:28 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 669.070058] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 669.077158] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 669.085581] binder: 6690:6691 Release 1 refcount change on invalid ref 1 ret -22 [ 669.094367] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 669.101606] binder: 6690:6691 BC_ACQUIRE_DONE u0000000000000000 no match [ 669.127887] bridge0: port 2(bridge_slave_1) entered blocking state [ 669.134106] binder: 6696:6697 ioctl c0306201 0 returned -14 [ 669.134312] bridge0: port 2(bridge_slave_1) entered forwarding state [ 669.151072] binder: 6693:6694 ioctl c0306201 0 returned -14 [ 669.154969] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 669.172747] binder: 6698:6699 ioctl c0306201 0 returned -14 [ 669.176407] binder: BINDER_SET_CONTEXT_MGR already set [ 669.179476] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 669.188252] binder: BINDER_SET_CONTEXT_MGR already set [ 669.196852] binder: 6693:6694 ioctl 40046207 0 returned -16 [ 669.197862] binder: BINDER_SET_CONTEXT_MGR already set [ 669.203299] binder: 6696:6697 ioctl 40046207 0 returned -16 [ 669.215936] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 669.220670] binder: 6698:6699 ioctl 40046207 0 returned -16 [ 669.223873] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 669.230276] binder_alloc: 6690: binder_alloc_buf, no vma [ 669.243504] binder_alloc: 6690: binder_alloc_buf, no vma [ 669.246338] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 669.249698] binder: 6693:6694 transaction failed 29189/-3, size 24-8 line 3035 [ 669.265088] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 669.268382] binder: 6693:6701 Release 1 refcount change on invalid ref 1 ret -22 [ 669.278636] binder: 6698:6699 Release 1 refcount change on invalid ref 1 ret -22 [ 669.290740] binder: 6696:6697 BC_ACQUIRE_DONE u0000000000000000 no match [ 669.297927] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 669.308841] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 669.325965] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 669.327652] binder: 6693:6694 BC_ACQUIRE_DONE u0000000000000000 no match [ 669.344810] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 669.352746] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 669.363790] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 669.371624] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 669.381599] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 669.399864] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 669.442228] binder: 6705:6706 ioctl c0306201 0 returned -14 [ 669.448428] binder: BINDER_SET_CONTEXT_MGR already set [ 669.460772] binder: 6705:6706 ioctl 40046207 0 returned -16 [ 669.467441] binder: 6705:6706 Release 1 refcount change on invalid ref 1 ret -22 [ 669.477508] binder_thread_write: 1 callbacks suppressed [ 669.477519] binder: 6705:6706 BC_ACQUIRE_DONE u0000000000000000 no match [ 669.819868] device bridge_slave_1 left promiscuous mode [ 669.825548] bridge0: port 2(bridge_slave_1) entered disabled state [ 669.880262] device bridge_slave_0 left promiscuous mode [ 669.885846] bridge0: port 1(bridge_slave_0) entered disabled state [ 670.031421] device hsr_slave_1 left promiscuous mode [ 670.074453] device hsr_slave_0 left promiscuous mode [ 670.134282] team0 (unregistering): Port device team_slave_1 removed [ 670.144596] team0 (unregistering): Port device team_slave_0 removed [ 670.154981] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 670.184653] bond0 (unregistering): Releasing backup interface bond_slave_0 19:26:29 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:29 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:29 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:29 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:29 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:29 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 670.281851] binder: 6709:6710 ioctl c0306201 0 returned -14 [ 670.294552] binder: BINDER_SET_CONTEXT_MGR already set [ 670.318948] binder: 6711:6714 ioctl c0306201 0 returned -14 [ 670.321178] binder: 6712:6713 ioctl c0306201 0 returned -14 [ 670.328582] binder: 6716:6717 ioctl c0306201 0 returned -14 [ 670.342430] binder: 6709:6710 ioctl 40046207 0 returned -16 [ 670.349776] binder: 6715:6718 ioctl c0306201 0 returned -14 [ 670.357839] binder: BINDER_SET_CONTEXT_MGR already set [ 670.365683] binder: 6721:6722 ioctl c0306201 0 returned -14 [ 670.378662] binder: 6711:6714 ioctl 40046207 0 returned -16 [ 670.379055] binder: BINDER_SET_CONTEXT_MGR already set [ 670.392703] bond0 (unregistering): Released all slaves [ 670.401724] binder: BINDER_SET_CONTEXT_MGR already set [ 670.407528] binder: BINDER_SET_CONTEXT_MGR already set [ 670.407542] binder_transaction: 3 callbacks suppressed [ 670.407563] binder: 6709:6720 transaction failed 29189/-3, size 24-8 line 3035 [ 670.426504] binder: 6716:6717 ioctl 40046207 0 returned -16 19:26:29 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 670.428114] binder: BINDER_SET_CONTEXT_MGR already set [ 670.433855] binder: 6721:6722 ioctl 40046207 0 returned -16 [ 670.444187] binder: 6712:6713 ioctl 40046207 0 returned -16 [ 670.450543] binder: 6711:6727 Release 1 refcount change on invalid ref 1 ret -22 [ 670.464999] binder: 6711:6727 BC_ACQUIRE_DONE u0000000000000000 no match [ 670.472366] binder: 6715:6718 ioctl 40046207 0 returned -16 [ 670.493054] binder: 6721:6722 Release 1 refcount change on invalid ref 1 ret -22 [ 670.494849] binder: 6716:6717 Release 1 refcount change on invalid ref 1 ret -22 [ 670.520448] binder: 6711:6714 transaction failed 29189/-3, size 24-8 line 3035 [ 670.524319] binder: 6712:6713 BC_ACQUIRE_DONE u0000000000000000 no match 19:26:29 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 670.539211] binder: 6716:6723 transaction failed 29189/-3, size 24-8 line 3035 [ 670.539923] binder: 6721:6722 BC_ACQUIRE_DONE u0000000000000000 no match [ 670.555385] binder: 6732:6734 ioctl c0306201 0 returned -14 [ 670.567035] binder: 6715:6718 transaction failed 29189/-3, size 24-8 line 3035 [ 670.567212] binder: BINDER_SET_CONTEXT_MGR already set 19:26:29 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 670.593759] binder: 6712:6726 transaction failed 29189/-3, size 24-8 line 3035 [ 670.604931] binder: 6721:6724 transaction failed 29189/-3, size 24-8 line 3035 [ 670.613511] binder: 6732:6734 ioctl 40046207 0 returned -16 [ 670.632018] binder: 6732:6736 transaction failed 29189/-3, size 24-8 line 3035 [ 670.642610] binder: 6715:6718 Release 1 refcount change on invalid ref 1 ret -22 [ 670.658808] binder: 6738:6740 ioctl c0306201 0 returned -14 [ 670.662089] binder: 6716:6739 BC_ACQUIRE_DONE u0000000000000000 no match [ 670.684350] binder: 6741:6742 ioctl c0306201 0 returned -14 19:26:30 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 670.693028] binder: 6715:6729 BC_ACQUIRE_DONE u0000000000000000 no match [ 670.693752] binder: BINDER_SET_CONTEXT_MGR already set [ 670.722210] binder: 6738:6740 ioctl 40046207 0 returned -16 [ 670.728177] binder: BINDER_SET_CONTEXT_MGR already set [ 670.735103] binder: 6741:6742 ioctl 40046207 0 returned -16 19:26:30 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:30 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 670.753206] binder: 6741:6742 transaction failed 29189/-3, size 24-8 line 3035 [ 670.761733] binder: 6738:6740 transaction failed 29189/-3, size 24-8 line 3035 [ 670.773216] binder: 6741:6742 Release 1 refcount change on invalid ref 1 ret -22 [ 670.786855] binder: 6738:6740 Release 1 refcount change on invalid ref 1 ret -22 [ 670.804206] binder: 6750:6752 ioctl c0306201 0 returned -14 [ 670.812370] binder: 6748:6749 ioctl c0306201 0 returned -14 [ 670.818058] binder: BINDER_SET_CONTEXT_MGR already set [ 670.834137] binder: 6738:6740 BC_ACQUIRE_DONE u0000000000000000 no match [ 670.843210] binder: 6750:6752 ioctl 40046207 0 returned -16 [ 670.847384] binder: BINDER_SET_CONTEXT_MGR already set 19:26:30 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:30 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 670.856514] binder: 6741:6742 BC_ACQUIRE_DONE u0000000000000000 no match [ 670.877691] binder: 6748:6749 ioctl 40046207 0 returned -16 [ 670.879684] binder: 6750:6752 transaction failed 29189/-3, size 24-8 line 3035 [ 670.884005] binder: 6755:6757 ioctl c0306201 0 returned -14 [ 670.947229] binder: 6764:6765 ioctl c0306201 0 returned -14 [ 670.948465] binder: 6766:6767 ioctl c0306201 0 returned -14 [ 670.955835] binder_alloc_new_buf_locked: 12 callbacks suppressed [ 670.955859] binder_alloc: 6690: binder_alloc_buf, no vma [ 670.959021] binder: BINDER_SET_CONTEXT_MGR already set [ 670.978506] binder: BINDER_SET_CONTEXT_MGR already set [ 670.989654] binder: 6755:6768 ioctl 40046207 0 returned -16 19:26:30 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:30 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 670.995646] binder: BINDER_SET_CONTEXT_MGR already set [ 671.001817] binder: 6766:6767 ioctl 40046207 0 returned -16 [ 671.007752] binder: 6764:6765 ioctl 40046207 0 returned -16 [ 671.008544] binder: undelivered TRANSACTION_ERROR: 29189 [ 671.018300] binder_alloc: 6690: binder_alloc_buf, no vma [ 671.029669] binder_alloc: 6690: binder_alloc_buf, no vma [ 671.036093] binder: 6766:6767 Release 1 refcount change on invalid ref 1 ret -22 19:26:30 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 671.064826] binder: 6764:6765 Release 1 refcount change on invalid ref 1 ret -22 19:26:30 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 671.136074] binder: 6776:6777 ioctl c0306201 0 returned -14 [ 671.139055] binder: 6773:6774 ioctl c0306201 0 returned -14 [ 671.163866] binder_alloc: 6690: binder_alloc_buf, no vma [ 671.167503] binder: BINDER_SET_CONTEXT_MGR already set [ 671.187424] binder: BINDER_SET_CONTEXT_MGR already set [ 671.192879] binder: 6755:6757 Release 1 refcount change on invalid ref 1 ret -22 [ 671.207628] binder: 6776:6777 ioctl 40046207 0 returned -16 [ 671.210055] binder: 6764:6765 BC_ACQUIRE_DONE u0000000000000000 no match [ 671.218453] binder: 6780:6781 ioctl c0306201 0 returned -14 19:26:30 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:30 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 671.234098] binder: 6778:6779 ioctl c0306201 0 returned -14 [ 671.243025] binder_alloc: 6690: binder_alloc_buf, no vma [ 671.248553] binder: BINDER_SET_CONTEXT_MGR already set [ 671.258654] binder: 6773:6774 ioctl 40046207 0 returned -16 [ 671.276355] binder: BINDER_SET_CONTEXT_MGR already set [ 671.276392] binder: 6780:6781 ioctl 40046207 0 returned -16 [ 671.282125] binder: 6778:6779 ioctl 40046207 0 returned -16 [ 671.303438] binder: 6755:6757 BC_ACQUIRE_DONE u0000000000000000 no match 19:26:30 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 671.333003] binder_alloc: 6690: binder_alloc_buf, no vma [ 671.349518] binder: 6780:6781 Release 1 refcount change on invalid ref 0 ret -22 [ 671.361694] binder: 6788:6789 ioctl c0306201 0 returned -14 19:26:30 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 671.382152] binder_alloc: 6690: binder_alloc_buf, no vma [ 671.385371] binder: BINDER_SET_CONTEXT_MGR already set [ 671.402590] binder: 6788:6789 ioctl 40046207 0 returned -16 [ 671.409841] binder_alloc: 6690: binder_alloc_buf, no vma [ 671.416787] binder: 6793:6795 ioctl c0306201 0 returned -14 19:26:30 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(0x0) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 671.431720] binder_alloc: 6690: binder_alloc_buf, no vma [ 671.448737] binder: BINDER_SET_CONTEXT_MGR already set [ 671.459822] binder: 6796:6797 ioctl c0306201 0 returned -14 [ 671.472630] binder: 6793:6795 ioctl 40046207 0 returned -16 [ 671.495160] binder_alloc: 6690: binder_alloc_buf, no vma [ 671.501498] binder: 6800:6802 ioctl c0306201 0 returned -14 [ 671.512712] binder: BINDER_SET_CONTEXT_MGR already set [ 671.533674] binder: 6796:6797 ioctl 40046207 0 returned -16 [ 671.537131] binder: BINDER_SET_CONTEXT_MGR already set 19:26:30 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) [ 671.555975] binder: 6805:6806 ioctl c0306201 0 returned -14 [ 671.558381] binder: 6800:6802 ioctl 40046207 0 returned -16 [ 671.571318] binder: BINDER_SET_CONTEXT_MGR already set [ 671.589203] binder: 6805:6806 ioctl 40046207 0 returned -16 19:26:30 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(0x0) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:31 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 671.692076] binder: 6813:6814 ioctl c0306201 0 returned -14 [ 671.732994] binder: 6816:6817 ioctl c0306201 0 returned -14 [ 671.741767] binder: BINDER_SET_CONTEXT_MGR already set [ 671.750145] binder: 6813:6814 ioctl 40046207 0 returned -16 [ 671.756440] binder: BINDER_SET_CONTEXT_MGR already set [ 671.763954] binder: 6816:6817 ioctl 40046207 0 returned -16 [ 671.774901] binder: 6818:6819 ioctl c0306201 0 returned -14 19:26:31 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(0x0) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 671.784892] binder: undelivered TRANSACTION_ERROR: 29189 [ 671.794044] binder: BINDER_SET_CONTEXT_MGR already set [ 671.817875] binder: 6818:6819 ioctl 40046207 0 returned -16 19:26:31 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) 19:26:31 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 671.908133] binder: 6824:6825 ioctl c0306201 0 returned -14 [ 671.929646] binder: BINDER_SET_CONTEXT_MGR already set [ 671.958066] binder: 6824:6825 ioctl 40046207 0 returned -16 [ 671.973285] binder: 6826:6827 ioctl c0306201 0 returned -14 19:26:31 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 672.008281] binder: BINDER_SET_CONTEXT_MGR already set [ 672.009982] binder: 6829:6830 ioctl c0306201 0 returned -14 [ 672.016883] binder: 6826:6827 ioctl 40046207 0 returned -16 [ 672.061989] binder: 6832:6833 ioctl c0306201 0 returned -14 [ 672.073912] binder: BINDER_SET_CONTEXT_MGR already set [ 672.089447] binder: 6829:6830 ioctl 40046207 0 returned -16 [ 672.096349] binder: BINDER_SET_CONTEXT_MGR already set [ 672.115771] binder: 6832:6833 ioctl 40046207 0 returned -16 [ 672.132728] binder: undelivered TRANSACTION_ERROR: 29189 19:26:31 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:31 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:31 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 672.221278] binder: 6838:6839 ioctl c0306201 0 returned -14 [ 672.241029] binder: 6841:6842 ioctl c0306201 0 returned -14 [ 672.256856] binder: BINDER_SET_CONTEXT_MGR already set 19:26:31 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 672.279345] binder: 6838:6839 ioctl 40046207 0 returned -16 [ 672.281375] binder: 6843:6844 ioctl c0306201 0 returned -14 [ 672.285552] binder: BINDER_SET_CONTEXT_MGR already set [ 672.300037] binder: 6841:6842 ioctl 40046207 0 returned -16 [ 672.311599] binder: BINDER_SET_CONTEXT_MGR already set 19:26:31 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) 19:26:31 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 672.336148] binder: 6843:6844 ioctl 40046207 0 returned -16 [ 672.433138] binder: 6851:6853 ioctl c0306201 0 returned -14 [ 672.475243] binder: BINDER_SET_CONTEXT_MGR already set [ 672.483353] binder: BINDER_SET_CONTEXT_MGR already set [ 672.488894] binder: 6855:6856 ioctl 40046207 0 returned -16 [ 672.495601] binder: 6851:6853 ioctl 40046207 0 returned -16 [ 672.510887] binder: 6857:6858 ioctl c0306201 0 returned -14 19:26:31 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(0x0) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:31 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 672.532542] binder: BINDER_SET_CONTEXT_MGR already set [ 672.537869] binder: 6857:6858 ioctl 40046207 0 returned -16 [ 672.615943] binder: 6864:6865 ioctl c0306201 0 returned -14 [ 672.633644] binder: undelivered TRANSACTION_ERROR: 29189 [ 672.650315] binder: BINDER_SET_CONTEXT_MGR already set [ 672.655673] binder: 6864:6865 ioctl 40046207 0 returned -16 19:26:32 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:32 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 672.696870] binder: BINDER_SET_CONTEXT_MGR already set [ 672.715519] binder: 6868:6869 ioctl 40046207 0 returned -16 19:26:32 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 672.748270] binder: 6872:6873 ioctl c0306201 0 returned -14 [ 672.774818] binder: BINDER_SET_CONTEXT_MGR already set [ 672.784231] binder: 6874:6875 ioctl c0306201 0 returned -14 [ 672.794765] binder: 6872:6873 ioctl 40046207 0 returned -16 [ 672.814748] binder: 6876:6878 ioctl c0306201 0 returned -14 [ 672.844569] binder: BINDER_SET_CONTEXT_MGR already set 19:26:32 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:32 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:32 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 672.887439] binder: 6874:6875 ioctl 40046207 0 returned -16 [ 672.894261] binder: BINDER_SET_CONTEXT_MGR already set [ 672.907074] binder: 6876:6878 ioctl 40046207 0 returned -16 [ 672.922438] binder: BINDER_SET_CONTEXT_MGR already set [ 672.937952] binder: 6885:6886 ioctl 40046207 0 returned -16 [ 672.948824] binder: 6883:6888 ioctl c0306201 0 returned -14 [ 672.970700] binder: 6889:6890 ioctl c0306201 0 returned -14 [ 672.981020] binder: BINDER_SET_CONTEXT_MGR already set 19:26:32 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:32 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 672.991001] binder: 6883:6888 ioctl 40046207 0 returned -16 [ 672.997487] binder: BINDER_SET_CONTEXT_MGR already set [ 673.026845] binder: 6889:6890 ioctl 40046207 0 returned -16 19:26:32 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 673.075182] binder: 6898:6899 ioctl c0306201 0 returned -14 19:26:32 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 673.137183] binder: 6902:6903 ioctl c0306201 0 returned -14 [ 673.147891] binder: BINDER_SET_CONTEXT_MGR already set [ 673.165208] binder: 6902:6903 ioctl 40046207 0 returned -16 [ 673.190856] binder: 6906:6907 ioctl c0306201 0 returned -14 [ 673.206544] binder: 6908:6909 ioctl c0306201 0 returned -14 [ 673.230858] binder: BINDER_SET_CONTEXT_MGR already set [ 673.247444] binder: 6908:6909 ioctl 40046207 0 returned -16 19:26:32 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:32 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 673.424571] binder: 6916:6918 ioctl c0306201 0 returned -14 [ 673.438785] binder: BINDER_SET_CONTEXT_MGR already set [ 673.449003] binder: 6916:6918 ioctl 40046207 0 returned -16 [ 673.465957] binder: BINDER_SET_CONTEXT_MGR already set [ 673.477999] binder: 6919:6920 ioctl 40046207 0 returned -16 19:26:32 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:32 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:32 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 673.605130] binder: 6925:6926 ioctl c0306201 0 returned -14 [ 673.623494] binder: 6928:6929 ioctl c0306201 0 returned -14 [ 673.628044] binder: BINDER_SET_CONTEXT_MGR already set [ 673.637977] binder: 6925:6926 ioctl 40046207 0 returned -16 [ 673.648510] binder: BINDER_SET_CONTEXT_MGR already set [ 673.662154] binder: 6928:6929 ioctl 40046207 0 returned -16 [ 673.663467] binder: BINDER_SET_CONTEXT_MGR already set [ 673.690686] binder: 6930:6931 ioctl 40046207 0 returned -16 19:26:33 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:33 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:33 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:33 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 673.817535] binder: BINDER_SET_CONTEXT_MGR already set [ 673.828482] binder: 6937:6943 ioctl c0306201 0 returned -14 [ 673.834480] binder: 6942:6944 ioctl c0306201 0 returned -14 [ 673.836967] binder: 6940:6941 ioctl c0306201 0 returned -14 [ 673.849271] binder: 6938:6939 ioctl 40046207 0 returned -16 [ 673.849816] binder: BINDER_SET_CONTEXT_MGR already set 19:26:33 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 673.873498] binder: 6942:6944 ioctl 40046207 0 returned -16 [ 673.879924] binder: BINDER_SET_CONTEXT_MGR already set [ 673.886170] binder: BINDER_SET_CONTEXT_MGR already set [ 673.892227] binder: 6937:6943 ioctl 40046207 0 returned -16 [ 673.909456] binder: 6940:6941 ioctl 40046207 0 returned -16 19:26:33 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:33 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) [ 673.956592] binder: BINDER_SET_CONTEXT_MGR already set [ 673.966434] binder: 6952:6953 ioctl 40046207 0 returned -16 19:26:33 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:33 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 674.047563] binder: 6958:6959 ioctl c0306201 0 returned -14 [ 674.062445] binder: 6961:6962 ioctl c0306201 0 returned -14 [ 674.072658] binder: BINDER_SET_CONTEXT_MGR already set [ 674.078457] binder: 6958:6959 ioctl 40046207 0 returned -16 [ 674.092757] binder: BINDER_SET_CONTEXT_MGR already set [ 674.098379] binder: 6961:6962 ioctl 40046207 0 returned -16 [ 674.111208] binder: 6965:6966 ioctl c0306201 0 returned -14 [ 674.117491] binder: 6963:6964 ioctl c0306201 0 returned -14 [ 674.124507] binder: undelivered TRANSACTION_ERROR: 29189 [ 674.141479] binder: BINDER_SET_CONTEXT_MGR already set 19:26:33 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:33 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 674.152079] binder: 6963:6964 ioctl 40046207 0 returned -16 [ 674.244018] binder: 6974:6976 ioctl c0306201 0 returned -14 [ 674.257321] binder: BINDER_SET_CONTEXT_MGR already set [ 674.264017] binder: 6974:6976 ioctl 40046207 0 returned -16 [ 674.268193] binder: 6977:6978 ioctl c0306201 0 returned -14 [ 674.283471] binder: BINDER_SET_CONTEXT_MGR already set [ 674.291431] binder: 6977:6978 ioctl 40046207 0 returned -16 19:26:33 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 674.439566] binder: 6984:6985 ioctl c0306201 0 returned -14 [ 674.446155] binder: BINDER_SET_CONTEXT_MGR already set [ 674.452382] binder: 6984:6985 ioctl 40046207 0 returned -16 19:26:33 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:33 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:33 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0}, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000080)=@req={0xac, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:33 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:33 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 674.633652] binder: 6987:6988 ioctl c0306201 0 returned -14 [ 674.642625] binder: 6990:6991 ioctl c0306201 0 returned -14 [ 674.650826] binder: 6993:6994 ioctl c0306201 0 returned -14 [ 674.655470] binder: 6995:6996 ioctl c0306201 0 returned -14 [ 674.662657] binder: 6989:6992 ioctl c0306201 0 returned -14 [ 674.665040] binder: BINDER_SET_CONTEXT_MGR already set [ 674.675769] binder: BINDER_SET_CONTEXT_MGR already set 19:26:34 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 674.675814] binder: 6993:6994 ioctl 40046207 0 returned -16 [ 674.681513] binder: BINDER_SET_CONTEXT_MGR already set [ 674.693005] binder: 6987:6988 ioctl 40046207 0 returned -16 [ 674.699525] binder: BINDER_SET_CONTEXT_MGR already set [ 674.704312] binder_thread_write: 29 callbacks suppressed [ 674.704333] binder: 6993:6994 BC_ACQUIRE_DONE u0000000000000000 no match [ 674.705021] binder: 6989:6992 ioctl 40046207 0 returned -16 [ 674.725190] binder: BINDER_SET_CONTEXT_MGR already set 19:26:34 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:34 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 674.725268] binder: 6995:6996 ioctl 40046207 0 returned -16 [ 674.746439] binder: 6995:6996 BC_ACQUIRE_DONE u0000000000000000 no match [ 674.749636] binder: 6990:6991 ioctl 40046207 0 returned -16 [ 674.794355] binder: 7002:7006 ioctl c0306201 0 returned -14 [ 674.825271] binder: BINDER_SET_CONTEXT_MGR already set 19:26:34 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) 19:26:34 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 674.844324] binder: 7008:7009 ioctl c0306201 0 returned -14 [ 674.855367] binder: 7002:7006 ioctl 40046207 0 returned -16 [ 674.865562] binder: BINDER_SET_CONTEXT_MGR already set [ 674.879360] binder: 7008:7009 ioctl 40046207 0 returned -16 [ 674.902737] binder: 7010:7011 ioctl c0306201 0 returned -14 [ 674.931759] binder: BINDER_SET_CONTEXT_MGR already set [ 674.939874] binder: 7008:7009 BC_ACQUIRE_DONE u0000000000000000 no match 19:26:34 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 674.950312] binder: 7010:7011 ioctl 40046207 0 returned -16 [ 674.968061] binder: 7017:7019 ioctl c0306201 0 returned -14 [ 674.979911] binder: 7018:7020 ioctl c0306201 0 returned -14 [ 674.984489] binder: BINDER_SET_CONTEXT_MGR already set [ 674.995508] binder: BINDER_SET_CONTEXT_MGR already set [ 675.006777] binder: 7017:7019 ioctl 40046207 0 returned -16 [ 675.014792] binder: 7018:7020 ioctl 40046207 0 returned -16 [ 675.033752] binder: 7023:7024 ioctl c0306201 0 returned -14 [ 675.038969] binder: 7010:7011 BC_ACQUIRE_DONE u0000000000000000 no match [ 675.053331] binder: BINDER_SET_CONTEXT_MGR already set [ 675.058669] binder: 7023:7024 ioctl 40046207 0 returned -16 [ 675.065038] binder: undelivered TRANSACTION_ERROR: 29189 [ 675.081731] binder: 7023:7024 ioctl c0306201 0 returned -14 [ 675.110001] binder: 7023:7024 BC_ACQUIRE_DONE u0000000000000000 no match 19:26:34 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 675.272005] binder: 7034:7035 ioctl c0306201 0 returned -14 [ 675.278634] binder: BINDER_SET_CONTEXT_MGR already set [ 675.284317] binder: 7034:7035 ioctl 40046207 0 returned -16 [ 675.304317] binder: 7034:7035 BC_ACQUIRE_DONE u0000000000000000 no match 19:26:34 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:34 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:34 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:34 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 675.482841] binder: 7037:7042 ioctl c0306201 0 returned -14 [ 675.483353] binder: 7040:7041 ioctl c0306201 0 returned -14 [ 675.494466] binder: 7043:7044 ioctl c0306201 0 returned -14 [ 675.495331] binder: BINDER_SET_CONTEXT_MGR already set [ 675.495457] binder: 7043:7044 ioctl 40046207 0 returned -16 [ 675.497581] binder_transaction: 60 callbacks suppressed [ 675.497620] binder: 7043:7044 transaction failed 29189/-3, size 24-8 line 3035 [ 675.507707] binder: 7038:7039 ioctl c0306201 0 returned -14 [ 675.515554] binder: BINDER_SET_CONTEXT_MGR already set [ 675.536108] binder_thread_write: 45 callbacks suppressed [ 675.536139] binder: 7043:7044 Release 1 refcount change on invalid ref 1 ret -22 [ 675.539368] binder: 7037:7042 ioctl 40046207 0 returned -16 [ 675.546598] binder: BINDER_SET_CONTEXT_MGR already set [ 675.562378] binder: BINDER_SET_CONTEXT_MGR already set [ 675.568407] binder: 7037:7042 transaction failed 29189/-3, size 24-8 line 3035 [ 675.576579] binder: 7038:7039 ioctl 40046207 0 returned -16 19:26:34 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:34 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 675.580417] binder: 7043:7044 BC_ACQUIRE_DONE u0000000000000000 no match [ 675.584967] binder: 7040:7041 ioctl c0306201 0 returned -14 [ 675.596055] binder: 7040:7045 ioctl 40046207 0 returned -16 [ 675.602545] binder: 7038:7046 transaction failed 29189/-3, size 0-8 line 3035 [ 675.603014] binder: 7040:7041 Release 1 refcount change on invalid ref 1 ret -22 [ 675.626466] binder: 7040:7041 BC_ACQUIRE_DONE u0000000000000000 no match 19:26:35 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 675.673299] binder: 7038:7039 Release 1 refcount change on invalid ref 1 ret -22 [ 675.712630] binder: 7052:7055 ioctl c0306201 0 returned -14 [ 675.724196] binder: 7053:7054 ioctl c0306201 0 returned -14 [ 675.744050] binder: BINDER_SET_CONTEXT_MGR already set [ 675.746257] binder: 7038:7039 BC_ACQUIRE_DONE u0000000000000000 no match [ 675.757281] binder: BINDER_SET_CONTEXT_MGR already set [ 675.762203] binder: 7053:7054 ioctl 40046207 0 returned -16 [ 675.765408] binder: 7052:7055 ioctl 40046207 0 returned -16 [ 675.772560] binder: 7053:7054 transaction failed 29189/-3, size 24-8 line 3035 [ 675.780732] binder: 7052:7055 ioctl c0306201 0 returned -14 [ 675.795962] binder: 7052:7055 Release 1 refcount change on invalid ref 1 ret -22 [ 675.807918] binder: 7057:7058 ioctl c0306201 0 returned -14 [ 675.815656] binder: BINDER_SET_CONTEXT_MGR already set 19:26:35 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:35 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:35 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 675.818788] binder: 7052:7055 BC_ACQUIRE_DONE u0000000000000000 no match [ 675.828514] binder: 7057:7058 ioctl 40046207 0 returned -16 [ 675.837576] binder: 7057:7058 transaction failed 29189/-3, size 24-8 line 3035 [ 675.850464] binder: 7057:7058 Release 1 refcount change on invalid ref 1 ret -22 [ 675.913576] binder: 7063:7064 ioctl c0306201 0 returned -14 [ 675.946549] binder: BINDER_SET_CONTEXT_MGR already set [ 675.950067] binder: 7069:7070 ioctl c0306201 0 returned -14 [ 675.963125] binder: 7067:7068 ioctl c0306201 0 returned -14 [ 675.969060] binder: 7063:7064 ioctl 40046207 0 returned -16 [ 675.969063] binder: BINDER_SET_CONTEXT_MGR already set [ 675.971270] binder: 7063:7064 Release 1 refcount change on invalid ref 1 ret -22 [ 675.975882] binder: 7069:7070 ioctl 40046207 0 returned -16 [ 675.981240] binder: BINDER_SET_CONTEXT_MGR already set [ 676.000792] binder: 7067:7068 ioctl 40046207 0 returned -16 [ 676.002849] binder_alloc_new_buf_locked: 55 callbacks suppressed 19:26:35 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 676.002884] binder_alloc: 6690: binder_alloc_buf, no vma [ 676.024960] binder: 7069:7070 transaction failed 29189/-3, size 24-8 line 3035 [ 676.032110] binder_alloc: 6690: binder_alloc_buf, no vma [ 676.038159] binder: 7067:7068 transaction failed 29189/-3, size 24-8 line 3035 [ 676.057114] binder: 7073:7074 ioctl c0306201 0 returned -14 19:26:35 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:35 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 676.095715] binder: BINDER_SET_CONTEXT_MGR already set [ 676.104556] binder: 7073:7074 ioctl 40046207 0 returned -16 [ 676.115835] binder: 7073:7074 Release 1 refcount change on invalid ref 1 ret -22 [ 676.116620] binder: 7067:7068 Release 1 refcount change on invalid ref 1 ret -22 [ 676.172717] binder: 7079:7082 ioctl c0306201 0 returned -14 [ 676.192667] binder: 7081:7083 ioctl c0306201 0 returned -14 [ 676.199646] binder: BINDER_SET_CONTEXT_MGR already set [ 676.207495] binder: BINDER_SET_CONTEXT_MGR already set [ 676.209179] binder: 7081:7083 ioctl 40046207 0 returned -16 [ 676.214580] binder: 7079:7082 ioctl 40046207 0 returned -16 [ 676.226766] binder_alloc: 6690: binder_alloc_buf, no vma [ 676.233549] binder_alloc: 6690: binder_alloc_buf, no vma [ 676.237442] binder: 7081:7083 transaction failed 29189/-3, size 24-8 line 3035 [ 676.239525] binder: 7079:7082 transaction failed 29189/-3, size 24-8 line 3035 [ 676.249437] binder: 7081:7083 Release 1 refcount change on invalid ref 1 ret -22 [ 676.271425] binder: undelivered TRANSACTION_ERROR: 29189 19:26:35 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:35 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:35 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:35 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:35 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:35 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 676.367033] binder: 7094:7095 ioctl c0306201 0 returned -14 [ 676.379842] binder: 7091:7092 ioctl c0306201 0 returned -14 [ 676.393126] binder: BINDER_SET_CONTEXT_MGR already set [ 676.398171] binder: 7093:7099 ioctl c0306201 0 returned -14 [ 676.400268] binder: BINDER_SET_CONTEXT_MGR already set [ 676.410021] binder: 7094:7095 ioctl 40046207 0 returned -16 [ 676.415825] binder: 7096:7097 ioctl c0306201 0 returned -14 [ 676.416092] binder: 7091:7092 ioctl 40046207 0 returned -16 [ 676.436156] binder_alloc: 6690: binder_alloc_buf, no vma [ 676.437588] binder: BINDER_SET_CONTEXT_MGR already set [ 676.444867] binder: 7091:7102 Release 1 refcount change on invalid ref 1 ret -22 [ 676.455928] binder: 7094:7095 transaction failed 29189/-3, size 24-8 line 3035 19:26:35 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:35 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 676.456754] binder: 7098:7100 ioctl c0306201 0 returned -14 [ 676.478191] binder: 7101:7103 ioctl c0306201 0 returned -14 [ 676.483052] binder: 7093:7099 ioctl 40046207 0 returned -16 [ 676.489204] binder: BINDER_SET_CONTEXT_MGR already set [ 676.496559] binder: 7096:7097 ioctl 40046207 0 returned -16 [ 676.505177] binder: BINDER_SET_CONTEXT_MGR already set [ 676.520703] binder: 7101:7103 ioctl 40046207 0 returned -16 [ 676.534531] binder_alloc: 6690: binder_alloc_buf, no vma [ 676.551851] binder_alloc: 6690: binder_alloc_buf, no vma [ 676.559101] binder: 7108:7109 ioctl c0306201 0 returned -14 19:26:35 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 676.572155] binder: 7111:7112 ioctl c0306201 0 returned -14 [ 676.590211] binder: BINDER_SET_CONTEXT_MGR already set [ 676.603935] binder: 7108:7109 ioctl 40046207 0 returned -16 [ 676.606117] binder_alloc: 6690: binder_alloc_buf, no vma [ 676.610086] binder: BINDER_SET_CONTEXT_MGR already set 19:26:36 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:36 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 676.633961] binder: 7111:7112 ioctl 40046207 0 returned -16 [ 676.635950] binder: BINDER_SET_CONTEXT_MGR already set [ 676.647611] binder_alloc: 6690: binder_alloc_buf, no vma [ 676.663844] binder: 7098:7100 ioctl 40046207 0 returned -16 [ 676.686602] binder_alloc: 6690: binder_alloc_buf, no vma [ 676.706048] binder: 7116:7122 ioctl c0306201 0 returned -14 19:26:36 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 676.730056] binder: 7123:7125 ioctl c0306201 0 returned -14 [ 676.745881] binder: BINDER_SET_CONTEXT_MGR already set [ 676.763234] binder: 7127:7128 ioctl c0306201 0 returned -14 [ 676.771449] binder: 7116:7122 ioctl 40046207 0 returned -16 19:26:36 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 676.777365] binder: BINDER_SET_CONTEXT_MGR already set [ 676.783925] binder: 7123:7125 ioctl 40046207 0 returned -16 [ 676.790136] binder: BINDER_SET_CONTEXT_MGR already set [ 676.799391] binder: 7127:7128 ioctl 40046207 0 returned -16 [ 676.878637] binder: 7137:7138 ioctl c0306201 0 returned -14 [ 676.886800] binder: 7140:7141 ioctl c0306201 0 returned -14 [ 676.895871] binder: BINDER_SET_CONTEXT_MGR already set [ 676.902261] binder: 7137:7138 ioctl 40046207 0 returned -16 [ 676.903230] binder: BINDER_SET_CONTEXT_MGR already set [ 676.914948] binder: 7140:7141 ioctl 40046207 0 returned -16 19:26:36 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:36 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:36 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 677.195327] binder: 7146:7147 ioctl c0306201 0 returned -14 [ 677.207822] binder: 7145:7148 ioctl c0306201 0 returned -14 [ 677.209035] binder: 7149:7150 ioctl c0306201 0 returned -14 [ 677.216538] binder: BINDER_SET_CONTEXT_MGR already set [ 677.225988] binder: 7146:7147 ioctl 40046207 0 returned -16 [ 677.229934] binder: BINDER_SET_CONTEXT_MGR already set 19:26:36 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 677.244893] binder: BINDER_SET_CONTEXT_MGR already set [ 677.245864] binder: 7149:7150 ioctl 40046207 0 returned -16 [ 677.268171] binder: 7145:7148 ioctl 40046207 0 returned -16 19:26:36 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 677.310402] binder: 7153:7155 ioctl c0306201 0 returned -14 [ 677.318989] binder: BINDER_SET_CONTEXT_MGR already set [ 677.335024] binder: 7153:7155 ioctl 40046207 0 returned -16 19:26:36 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:36 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 677.364377] binder: 7217:7226 ioctl c0306201 0 returned -14 [ 677.386524] binder: BINDER_SET_CONTEXT_MGR already set [ 677.400266] binder: 7217:7226 ioctl 40046207 0 returned -16 [ 677.454602] binder: 7261:7263 ioctl c0306201 0 returned -14 [ 677.478267] binder: BINDER_SET_CONTEXT_MGR already set [ 677.492276] binder: 7261:7263 ioctl 40046207 0 returned -16 19:26:36 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 677.531794] binder: 7265:7266 ioctl c0306201 0 returned -14 [ 677.563923] binder: BINDER_SET_CONTEXT_MGR already set 19:26:36 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:37 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 677.586401] binder: 7265:7266 ioctl 40046207 0 returned -16 [ 677.625034] binder: 7269:7270 ioctl c0306201 0 returned -14 19:26:37 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 677.684261] binder: BINDER_SET_CONTEXT_MGR already set [ 677.695049] binder: 7275:7276 ioctl c0306201 0 returned -14 19:26:37 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 677.731200] binder: 7269:7277 ioctl 40046207 0 returned -16 [ 677.737017] binder: BINDER_SET_CONTEXT_MGR already set [ 677.750048] binder: 7275:7276 ioctl 40046207 0 returned -16 [ 677.795843] binder: 7280:7281 ioctl c0306201 0 returned -14 [ 677.803507] binder: 7283:7285 ioctl c0306201 0 returned -14 [ 677.819609] binder: BINDER_SET_CONTEXT_MGR already set [ 677.826831] binder: BINDER_SET_CONTEXT_MGR already set [ 677.839479] binder: 7283:7285 ioctl 40046207 0 returned -16 [ 677.845398] binder: 7280:7281 ioctl 40046207 0 returned -16 19:26:37 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:37 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:37 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 677.976652] binder: 7292:7293 ioctl c0306201 0 returned -14 [ 677.996151] binder: BINDER_SET_CONTEXT_MGR already set [ 678.015467] binder: 7292:7293 ioctl 40046207 0 returned -16 19:26:37 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 678.062775] binder: 7295:7296 ioctl c0306201 0 returned -14 [ 678.080164] binder: 7297:7298 ioctl c0306201 0 returned -14 [ 678.087506] binder: BINDER_SET_CONTEXT_MGR already set 19:26:37 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 678.122015] binder: 7295:7296 ioctl 40046207 0 returned -16 [ 678.122039] binder: BINDER_SET_CONTEXT_MGR already set [ 678.122145] binder: 7297:7298 ioctl 40046207 0 returned -16 [ 678.158931] binder: 7300:7301 ioctl c0306201 0 returned -14 [ 678.195560] binder: BINDER_SET_CONTEXT_MGR already set [ 678.208316] binder: 7300:7301 ioctl 40046207 0 returned -16 [ 678.219510] binder: 7306:7307 ioctl c0306201 0 returned -14 [ 678.237324] binder: BINDER_SET_CONTEXT_MGR already set [ 678.246584] binder: 7306:7307 ioctl 40046207 0 returned -16 19:26:37 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:37 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 678.375931] binder: 7314:7315 ioctl c0306201 0 returned -14 [ 678.379034] binder: BINDER_SET_CONTEXT_MGR already set [ 678.389624] binder: 7312:7313 ioctl 40046207 0 returned -16 [ 678.405667] binder: BINDER_SET_CONTEXT_MGR already set 19:26:37 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 678.428856] binder: 7314:7315 ioctl 40046207 0 returned -16 19:26:37 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:37 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:37 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 678.571784] binder: 7320:7325 ioctl c0306201 0 returned -14 [ 678.588170] binder: 7327:7328 ioctl c0306201 0 returned -14 [ 678.611008] binder: BINDER_SET_CONTEXT_MGR already set [ 678.617365] binder: 7327:7328 ioctl 40046207 0 returned -16 [ 678.624150] binder: BINDER_SET_CONTEXT_MGR already set [ 678.639262] binder: 7320:7329 ioctl 40046207 0 returned -16 [ 678.656610] binder: 7330:7331 ioctl c0306201 0 returned -14 [ 678.663963] binder: BINDER_SET_CONTEXT_MGR already set [ 678.672376] binder: 7330:7331 ioctl 40046207 0 returned -16 [ 679.300221] device bridge_slave_1 left promiscuous mode [ 679.305752] bridge0: port 2(bridge_slave_1) entered disabled state [ 679.370037] device bridge_slave_0 left promiscuous mode [ 679.375474] bridge0: port 1(bridge_slave_0) entered disabled state [ 679.512389] device hsr_slave_1 left promiscuous mode [ 679.554081] device hsr_slave_0 left promiscuous mode [ 679.593598] team0 (unregistering): Port device team_slave_1 removed [ 679.604148] team0 (unregistering): Port device team_slave_0 removed [ 679.615678] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 679.654390] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 679.720605] bond0 (unregistering): Released all slaves [ 680.248256] IPVS: ftp: loaded support on port[0] = 21 [ 680.331138] chnl_net:caif_netlink_parms(): no params data found [ 680.367193] bridge0: port 1(bridge_slave_0) entered blocking state [ 680.373674] bridge0: port 1(bridge_slave_0) entered disabled state [ 680.381551] device bridge_slave_0 entered promiscuous mode [ 680.388718] bridge0: port 2(bridge_slave_1) entered blocking state [ 680.395212] bridge0: port 2(bridge_slave_1) entered disabled state [ 680.402298] device bridge_slave_1 entered promiscuous mode [ 680.419755] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 680.428743] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 680.454348] team0: Port device team_slave_0 added [ 680.462968] team0: Port device team_slave_1 added [ 680.543814] device hsr_slave_0 entered promiscuous mode [ 680.609447] device hsr_slave_1 entered promiscuous mode [ 680.707010] bridge0: port 2(bridge_slave_1) entered blocking state [ 680.713415] bridge0: port 2(bridge_slave_1) entered forwarding state [ 680.720070] bridge0: port 1(bridge_slave_0) entered blocking state [ 680.726414] bridge0: port 1(bridge_slave_0) entered forwarding state [ 680.780152] 8021q: adding VLAN 0 to HW filter on device bond0 [ 680.792388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 680.800448] bridge0: port 1(bridge_slave_0) entered disabled state [ 680.807425] bridge0: port 2(bridge_slave_1) entered disabled state [ 680.820878] 8021q: adding VLAN 0 to HW filter on device team0 [ 680.831196] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 680.838737] bridge0: port 1(bridge_slave_0) entered blocking state [ 680.845113] bridge0: port 1(bridge_slave_0) entered forwarding state [ 680.855026] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 680.863474] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 680.871144] bridge0: port 2(bridge_slave_1) entered blocking state [ 680.877478] bridge0: port 2(bridge_slave_1) entered forwarding state [ 680.898213] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 680.908299] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 680.924461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 680.932766] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 680.947066] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 680.954854] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 680.965243] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 680.972901] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 680.980614] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 680.987997] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 680.995501] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 681.002891] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 681.020614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 681.027208] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 681.034398] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 681.084819] binder: 7343:7344 ioctl c0306201 0 returned -14 [ 681.093015] binder_alloc_new_buf_locked: 25 callbacks suppressed [ 681.093059] binder_alloc: 7343: binder_alloc_buf, no vma [ 681.107201] binder_transaction: 30 callbacks suppressed [ 681.107221] binder: 7343:7344 transaction failed 29189/-3, size 0-8 line 3035 [ 681.122361] binder_thread_write: 20 callbacks suppressed [ 681.122380] binder: 7343:7344 Release 1 refcount change on invalid ref 1 ret -22 19:26:40 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:40 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:40 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(0x0) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) 19:26:40 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:40 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:40 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 681.216592] binder: 7350:7351 ioctl c0306201 0 returned -14 [ 681.222459] binder: 7353:7354 ioctl c0306201 0 returned -14 [ 681.228783] binder: 7348:7355 ioctl c0306201 0 returned -14 [ 681.242645] binder: 7346:7356 ioctl c0306201 0 returned -14 [ 681.243388] binder: 7347:7349 ioctl c0306201 0 returned -14 [ 681.251192] binder_alloc: 7353: binder_alloc_buf, no vma [ 681.265987] binder: 7358:7359 ioctl c0306201 0 returned -14 [ 681.267521] binder: BINDER_SET_CONTEXT_MGR already set [ 681.278079] binder: 7353:7354 transaction failed 29189/-3, size 24-8 line 3035 [ 681.285653] binder: 7353:7363 Release 1 refcount change on invalid ref 1 ret -22 [ 681.285836] binder: 7346:7356 ioctl 40046207 0 returned -16 [ 681.288159] binder_alloc: 7353: binder_alloc_buf, no vma [ 681.293995] binder: BINDER_SET_CONTEXT_MGR already set [ 681.302934] binder_thread_write: 22 callbacks suppressed 19:26:40 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 681.302944] binder: 7353:7363 BC_ACQUIRE_DONE u0000000000000000 no match [ 681.312265] binder: 7346:7356 transaction failed 29189/-3, size 24-8 line 3035 [ 681.317739] binder: 7347:7349 ioctl 40046207 0 returned -16 [ 681.324747] binder_alloc: 7353: binder_alloc_buf, no vma [ 681.331564] binder: BINDER_SET_CONTEXT_MGR already set [ 681.352007] binder: 7347:7360 transaction failed 29189/-3, size 24-8 line 3035 19:26:40 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(0x0) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 681.391593] binder: 7347:7360 Release 1 refcount change on invalid ref 1 ret -22 [ 681.395855] binder: 7350:7362 ioctl 40046207 0 returned -16 [ 681.399790] binder: BINDER_SET_CONTEXT_MGR already set [ 681.405466] binder: 7358:7440 Release 1 refcount change on invalid ref 1 ret -22 [ 681.424636] binder: 7358:7440 BC_ACQUIRE_DONE u0000000000000000 no match [ 681.432088] binder: 7422:7445 ioctl c0306201 0 returned -14 [ 681.448053] binder: BINDER_SET_CONTEXT_MGR already set [ 681.456935] binder: 7348:7355 ioctl 40046207 0 returned -16 [ 681.463346] binder: 7347:7349 BC_ACQUIRE_DONE u0000000000000000 no match [ 681.473123] binder: 7358:7359 ioctl 40046207 0 returned -16 [ 681.474443] binder: 7350:7362 Release 1 refcount change on invalid ref 1 ret -22 [ 681.498135] binder_alloc: 7353: binder_alloc_buf, no vma [ 681.509848] binder: BINDER_SET_CONTEXT_MGR already set [ 681.515921] binder: 7422:7482 ioctl 40046207 0 returned -16 [ 681.524842] binder: 7350:7362 BC_ACQUIRE_DONE u0000000000000000 no match [ 681.532274] binder: 7483:7484 ioctl c0306201 0 returned -14 [ 681.545587] binder: 7358:7361 transaction failed 29189/-3, size 0-8 line 3035 [ 681.546430] binder_alloc: 7353: binder_alloc_buf, no vma [ 681.555906] binder: BINDER_SET_CONTEXT_MGR already set [ 681.573498] binder: 7483:7484 ioctl 40046207 0 returned -16 [ 681.588919] binder: 7350:7351 transaction failed 29189/-3, size 24-8 line 3035 19:26:40 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 681.596925] binder_alloc: 7353: binder_alloc_buf, no vma [ 681.622705] binder: 7422:7482 Release 1 refcount change on invalid ref 1 ret -22 [ 681.658407] binder: 7422:7482 BC_ACQUIRE_DONE u0000000000000000 no match [ 681.673195] binder_alloc: 7353: binder_alloc_buf, no vma [ 681.684467] binder: 7483:7484 transaction failed 29189/-3, size 24-8 line 3035 [ 681.693241] binder: 7422:7445 transaction failed 29189/-3, size 24-8 line 3035 [ 681.718006] binder: 7490:7491 ioctl c0306201 0 returned -14 19:26:41 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x4, 0x4, 0x4, 0x9}, 0x2c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x400000, 0x0, 0x10020000000, 0x0}, 0x2c) 19:26:41 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(0x0) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 681.784602] binder: BINDER_SET_CONTEXT_MGR already set [ 681.824193] binder: 7490:7493 ioctl 40046207 0 returned -16 19:26:41 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:41 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000080)=@req={0x0, 0x5, 0x81, 0xffffffffffff7751}, 0x10) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 681.834329] binder_alloc: 7353: binder_alloc_buf, no vma [ 681.879757] binder: 7490:7491 transaction failed 29189/-3, size 0-8 line 3035 [ 681.913444] binder: 7506:7508 ioctl c0306201 0 returned -14 [ 681.922015] binder: 7509:7510 ioctl c0306201 0 returned -14 19:26:41 executing program 5: [ 681.940826] binder: BINDER_SET_CONTEXT_MGR already set [ 681.946324] binder: 7509:7510 ioctl 40046207 0 returned -16 [ 681.950173] binder: BINDER_SET_CONTEXT_MGR already set [ 681.953862] binder: 7490:7491 Release 1 refcount change on invalid ref 1 ret -22 [ 681.969564] binder: 7506:7508 ioctl 40046207 0 returned -16 [ 681.979734] binder_alloc: 7353: binder_alloc_buf, no vma 19:26:41 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 681.985235] binder: 7509:7512 transaction failed 29189/-3, size 24-8 line 3035 19:26:41 executing program 5: 19:26:41 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 682.056303] binder: 7526:7527 ioctl c0306201 0 returned -14 [ 682.093137] binder: BINDER_SET_CONTEXT_MGR already set [ 682.119775] binder: 7509:7510 Release 1 refcount change on invalid ref 1 ret -22 [ 682.144313] binder: 7526:7527 ioctl 40046207 0 returned -16 19:26:41 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:41 executing program 5: [ 682.172678] binder: 7526:7532 Release 1 refcount change on invalid ref 1 ret -22 [ 682.182048] binder: 7509:7512 BC_ACQUIRE_DONE u0000000000000000 no match [ 682.221029] binder: BINDER_SET_CONTEXT_MGR already set [ 682.226467] binder: 7533:7534 ioctl 40046207 0 returned -16 19:26:41 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) [ 682.265363] binder: 7526:7527 BC_ACQUIRE_DONE u0000000000000000 no match [ 682.266587] binder: 7538:7540 ioctl c0306201 0 returned -14 19:26:41 executing program 5: [ 682.319595] binder: BINDER_SET_CONTEXT_MGR already set [ 682.355591] binder: 7538:7548 ioctl 40046207 0 returned -16 [ 682.368445] binder: 7538:7540 Release 1 refcount change on invalid ref 1 ret -22 19:26:41 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() r1 = getpgid(0x0) tgkill(r0, r1, 0x0) [ 682.406188] binder: BINDER_SET_CONTEXT_MGR already set [ 682.456628] binder: 7550:7553 ioctl 40046207 0 returned -16 19:26:41 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) fallocate(r1, 0x0, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000140)=0x4) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 19:26:42 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000940)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x30, 0x0, 0xf0}, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000044}, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000007c0)={0xffffffffffffffff, 0x9}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 682.657279] binder: 7564:7565 ioctl c0306201 0 returned -14 [ 682.683804] binder: BINDER_SET_CONTEXT_MGR already set [ 682.697033] binder: 7564:7565 ioctl 40046207 0 returned -16 [ 682.825567] binder: 7569:7570 ioctl c0306201 0 returned -14 [ 682.886949] binder: BINDER_SET_CONTEXT_MGR already set [ 682.931617] binder: 7569:7571 ioctl 40046207 0 returned -16 [ 682.942814] binder: 7569:7570 BC_ACQUIRE_DONE u0000000000000000 no match [ 683.689594] device bridge_slave_1 left promiscuous mode [ 683.695170] bridge0: port 2(bridge_slave_1) entered disabled state [ 683.760038] device bridge_slave_0 left promiscuous mode [ 683.765474] bridge0: port 1(bridge_slave_0) entered disabled state [ 683.864399] device hsr_slave_1 left promiscuous mode [ 683.934207] device hsr_slave_0 left promiscuous mode [ 683.993714] team0 (unregistering): Port device team_slave_1 removed [ 684.003986] team0 (unregistering): Port device team_slave_0 removed [ 684.013912] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 684.043481] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 684.126933] bond0 (unregistering): Released all slaves [ 684.333698] WARNING: CPU: 1 PID: 924 at net/batman-adv/multicast.c:371 batadv_mcast_mla_update+0x1927/0x1ec0 [ 684.343869] Kernel panic - not syncing: panic_on_warn set ... [ 684.349730] CPU: 1 PID: 924 Comm: kworker/u4:3 Not tainted 5.0.0-rc8+ #3 [ 684.356544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 684.365884] Workqueue: bat_events batadv_mcast_mla_update [ 684.371394] Call Trace: [ 684.373961] dump_stack+0x172/0x1f0 [ 684.377572] ? batadv_mcast_mla_update+0x1830/0x1ec0 [ 684.382707] panic+0x2cb/0x65c [ 684.385877] ? __warn_printk+0xf3/0xf3 [ 684.389743] ? batadv_mcast_mla_update+0x1927/0x1ec0 [ 684.394839] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 684.400353] ? __warn.cold+0x5/0x45 [ 684.403956] ? __warn+0xe8/0x1d0 [ 684.407304] ? batadv_mcast_mla_update+0x1927/0x1ec0 [ 684.412389] __warn.cold+0x20/0x45 [ 684.415910] ? batadv_mcast_mla_update+0x1927/0x1ec0 [ 684.421000] report_bug+0x263/0x2b0 [ 684.424639] do_error_trap+0x11b/0x200 [ 684.428508] do_invalid_op+0x37/0x50 [ 684.432205] ? batadv_mcast_mla_update+0x1927/0x1ec0 [ 684.437286] invalid_op+0x14/0x20 [ 684.440719] RIP: 0010:batadv_mcast_mla_update+0x1927/0x1ec0 [ 684.446404] Code: 00 0f 85 95 05 00 00 4c 3b ad d0 fe ff ff 4c 89 ef 4d 8b 65 00 0f 85 a0 fb ff ff e8 33 24 89 fa e9 a6 ef ff ff e8 29 24 89 fa <0f> 0b e9 64 ec ff ff e8 1d 24 89 fa 8b b5 a8 fe ff ff 31 ff e8 90 [ 684.465281] RSP: 0018:ffff8880a80c7bc0 EFLAGS: 00010293 [ 684.470620] RAX: ffff8880a8786680 RBX: 0000000000000001 RCX: ffffffff86e6a759 [ 684.477865] RDX: 0000000000000000 RSI: ffffffff86e6baf7 RDI: 0000000000000007 [ 684.485113] RBP: ffff8880a80c7d30 R08: ffff8880a8786680 R09: ffff8880a8786f48 [ 684.492380] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a80c7c98 [ 684.499629] R13: ffff888036500950 R14: 0000000000000000 R15: ffff8880a80c7d08 [ 684.506881] ? batadv_mcast_mla_update+0x589/0x1ec0 [ 684.511875] ? batadv_mcast_mla_update+0x1927/0x1ec0 [ 684.516999] ? kasan_check_read+0x10/0x20 [ 684.521130] ? batadv_mcast_querier_log.isra.0+0x140/0x140 [ 684.526795] ? check_preemption_disabled+0x48/0x290 [ 684.531820] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 684.537264] process_one_work+0x98e/0x1790 [ 684.541482] ? pwq_dec_nr_in_flight+0x320/0x320 [ 684.546140] ? lock_acquire+0x16f/0x3f0 [ 684.550097] worker_thread+0x98/0xe40 [ 684.553902] ? trace_hardirqs_on+0x67/0x230 [ 684.558221] kthread+0x357/0x430 [ 684.561568] ? process_one_work+0x1790/0x1790 [ 684.566043] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 684.571568] ret_from_fork+0x3a/0x50 [ 684.576612] Kernel Offset: disabled [ 684.580342] Rebooting in 86400 seconds..