xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 7 printk messages dropped ** [ 795.326988] binder: 14114:14118 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 795.383747] binder: 14128:14135 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 1 printk messages dropped ** [ 795.423050] binder: 14136:14140 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 9 printk messages dropped ** [ 795.500180] binder: 14163:14167 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 1 printk messages dropped ** [ 795.525776] binder: 14166:14168 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 795.591784] binder: 14178:14187 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 795.658188] binder: 14200:14205 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 795.722150] binder: 14213:14216 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 795.788804] binder: 14233:14235 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 795.836707] binder: 14248:14253 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 3 printk messages dropped ** [ 795.873188] binder: 14257:14260 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 795.931020] binder: 14269:14274 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 795.971036] binder: 14273:14286 transaction failed 29189/-22, size 0-0 line 3119 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 796.031820] binder: 14298:14303 transaction failed 29189/-22, size 0-0 line 3119 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 796.076065] binder: 14307:14311 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 796.100136] binder: 14318:14320 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 4 printk messages dropped ** [ 796.155058] binder: 14330:14335 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 796.222853] binder: 14347:14351 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 796.268388] binder: 14357:14358 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 9 printk messages dropped ** [ 796.347952] binder: 14377:14380 transaction failed 29189/-22, size 0-0 line 3119 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 1 printk messages dropped ** [ 796.360569] binder: 14383:14386 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 796.437904] binder: 14398:14404 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 796.508297] binder: 14418:14423 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 796.579295] binder: 14436:14444 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 7 printk messages dropped ** [ 796.644224] binder: 14452:14454 transaction failed 29189/-22, size 0-0 line 3119 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 796.697565] binder: 14470:14474 transaction failed 29189/-22, size 0-0 line 3119 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 796.749013] binder: 14482:14486 transaction failed 29189/-22, size 0-0 line 3119 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 796.822964] binder: 14496:14498 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 796.826504] binder: 14495:14499 transaction failed 29189/-22, size 0-0 line 3119 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 9 printk messages dropped ** [ 796.945502] binder: 14528:14530 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 3 printk messages dropped ** [ 796.992309] binder: 14534:14538 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 797.064633] binder: 14553:14560 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 797.141809] binder: 14570:14576 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 797.198856] binder: 14585:14587 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 797.211318] binder: 14590:14597 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 4 printk messages dropped ** [ 797.261322] binder: 14602:14607 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 797.340992] binder: 14619:14627 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 797.410592] binder: 14641:14646 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 797.468010] binder: 14656:14660 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 797.536148] binder: 14675:14680 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 797.560594] binder: 14674:14678 transaction failed 29189/-22, size 0-0 line 3119 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 7 printk messages dropped ** [ 797.658362] binder: 14701:14708 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 797.735028] binder: 14726:14728 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 797.735156] binder: 14726:14728 transaction failed 29189/-22, size 0-0 line 3119 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 797.788679] binder: 14720:14727 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 797.872214] binder: 14755:14761 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 797.927966] binder: 14771:14776 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 797.995020] binder: 14789:14796 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 798.054992] binder: 14807:14813 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 798.117342] binder: 14819:14830 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 798.117476] binder: 14819:14830 Release 1 refcount change on invalid ref 0 ret -22 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 798.117489] binder: 14819:14830 transaction failed 29189/-22, size 0-0 line 3119 [ 798.130989] binder: 14829:14832 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 2 printk messages dropped ** [ 798.167537] binder: 14837:14841 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 3 printk messages dropped ** [ 798.179819] binder: 14843:14846 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 798.234182] binder: 14852:14856 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 798.295966] binder: 14870:14873 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 1 printk messages dropped ** [ 798.351771] binder: 14880:14889 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 1 printk messages dropped ** [ 798.354620] binder: 14882:14890 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 7 printk messages dropped ** [ 798.406189] binder: 14901:14903 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 798.450998] binder: 14913:14914 transaction failed 29189/-22, size 0-0 line 3119 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 9 printk messages dropped ** [ 798.578802] binder: 14938:14946 transaction failed 29189/-22, size 0-0 line 3119 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 798.635886] binder: 14957:14962 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 798.693480] binder: 14975:14978 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 798.732585] binder: 14984:14989 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 1 printk messages dropped ** [ 798.800875] binder: 14994:15003 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 798.832679] binder: 15010:15013 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 798.878323] binder: 15025:15027 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 798.936241] binder: 15039:15043 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 798.979539] binder: 15054:15056 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 799.050740] binder: 15063:15072 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 799.131187] binder: 15086:15094 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 799.204089] binder: 15102:15108 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 3 printk messages dropped ** [ 799.235088] binder: 15117:15121 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 3 printk messages dropped ** [ 799.252778] binder: 15122:15128 transaction failed 29189/-22, size 0-0 line 3119 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 799.355907] binder: 15138:15147 transaction failed 29189/-22, size 0-0 line 3119 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 799.398889] binder: 15157:15164 transaction failed 29189/-22, size 0-0 line 3119 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 799.483976] binder: 15175:15180 transaction failed 29189/-22, size 0-0 line 3119 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 9 printk messages dropped ** [ 799.625353] binder: 15220:15223 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 5 printk messages dropped ** [ 799.685506] binder: 15231:15240 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 799.685630] binder: 15231:15240 transaction failed 29189/-22, size 0-0 line 3119 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 799.729713] binder: 15246:15247 transaction failed 29189/-22, size 0-0 line 3119 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 799.800684] binder: 15258:15264 transaction failed 29189/-22, size 0-0 line 3119 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 9 printk messages dropped ** [ 799.930244] binder: 15297:15300 transaction failed 29189/-22, size 0-0 line 3119 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 799.981633] binder: 15306:15312 transaction failed 29189/-22, size 0-0 line 3119 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 800.003058] binder: 15316:15318 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 3 printk messages dropped ** [ 800.064175] binder: 15321:15331 transaction failed 29189/-22, size 0-0 line 3119 ** 5 printk messages dropped ** [ 800.093987] binder: 15342:15343 transaction failed 29189/-22, size 0-0 line 3119 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 800.183676] binder: 15351:15362 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 800.200851] binder: 15356:15361 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 800.200864] binder: 15356:15361 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 3 printk messages dropped ** [ 800.223809] binder: 15373:15376 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 800.308795] binder: 15386:15393 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 1 printk messages dropped ** [ 800.331149] binder: 15391:15398 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 800.408794] binder: 15411:15419 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 7 printk messages dropped ** [ 800.472739] binder: 15427:15440 transaction failed 29189/-22, size 0-0 line 3119 [ 800.519214] binder: 15445:15449 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 4 printk messages dropped ** [ 800.521215] binder: 15446:15450 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 800.574147] binder: 15460:15464 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 800.628136] binder: 15471:15474 transaction failed 29189/-22, size 0-0 line 3119 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 800.663811] binder: 15489:15492 Acquire 1 refcount change on invalid ref 0 ret -22 ** 4 printk messages dropped ** [ 800.683844] binder: 15487:15491 transaction failed 29189/-22, size 0-0 line 3119 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 800.748596] binder: 15504:15509 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 800.802350] binder: 15521:15524 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 4 printk messages dropped ** [ 800.812757] binder: 15522:15525 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 800.880372] binder: 15538:15543 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 1 printk messages dropped ** [ 800.918405] binder: 15552:15554 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 7 printk messages dropped ** [ 801.002805] binder: 15571:15574 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 3 printk messages dropped ** [ 801.045835] binder: 15577:15583 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 801.087956] binder: 15596:15600 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 801.125068] binder: 15608:15610 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 9 printk messages dropped ** [ 801.239287] binder: 15630:15639 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 801.305900] binder: 15646:15650 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 3 printk messages dropped ** [ 801.344094] binder: 15660:15661 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 801.402498] binder: 15674:15680 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 801.477610] binder: 15688:15695 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 801.544577] binder: 15703:15715 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 801.594922] binder: 15722:15730 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 801.677453] binder: 15737:15742 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 801.735389] binder: 15756:15765 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 801.787169] binder: 15772:15778 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 7 printk messages dropped ** [ 801.894592] binder: 15797:15803 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 9 printk messages dropped ** [ 801.970399] binder: 15817:15825 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 7 printk messages dropped ** [ 802.085481] binder: 15847:15851 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 3 printk messages dropped ** [ 802.129573] binder: 15853:15859 transaction failed 29189/-22, size 0-0 line 3119 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 802.150821] binder: 15862:15867 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 802.199059] binder: 15874:15880 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 5 printk messages dropped ** [ 802.290412] binder: 15894:15900 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 802.310300] binder: 15904:15905 Acquire 1 refcount change on invalid ref 0 ret -22 ** 4 printk messages dropped ** [ 802.352131] binder: 15913:15918 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 802.411348] binder: 15927:15932 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 3 printk messages dropped ** [ 802.442667] binder: 15931:15937 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 1 printk messages dropped ** [ 802.459426] binder: 15944:15948 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 9 printk messages dropped ** [ 802.564463] binder: 15970:15976 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 802.622502] binder: 15986:15990 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 802.679581] binder: 16000:16008 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 802.742595] binder: 16017:16024 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 9 printk messages dropped ** [ 802.837842] binder: 16035:16044 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 802.904631] binder: 16056:16063 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 802.943196] binder: 16071:16074 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 802.998092] binder: 16084:16087 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 803.081994] binder: 16109:16112 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 803.145940] binder: 16125:16134 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 803.207685] binder: 16139:16142 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 803.263700] binder: 16156:16164 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 5 printk messages dropped ** [ 803.320108] binder: 16175:16180 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 803.404910] binder: 16197:16199 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 803.465773] binder: 16209:16215 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 803.465918] binder: 16209:16215 transaction failed 29189/-22, size 0-0 line 3119 ** 5 printk messages dropped ** [ 803.527300] binder: 16226:16231 transaction failed 29189/-22, size 0-0 line 3119 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 803.564260] binder: 16243:16245 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 11 printk messages dropped ** [ 803.658519] binder: 16257:16264 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 803.721618] binder: 16272:16278 transaction failed 29189/-22, size 0-0 line 3119 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 7 printk messages dropped ** [ 803.845886] binder: 16308:16317 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 803.846006] binder: 16308:16317 Release 1 refcount change on invalid ref 0 ret -22 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 4 printk messages dropped ** [ 803.918403] binder: 16324:16334 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 803.988426] binder: 16346:16350 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 804.044058] binder: 16362:16364 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 9 printk messages dropped ** [ 804.116741] binder: 16378:16387 transaction failed 29189/-22, size 0-0 line 3119 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 804.177843] binder: 16396:16404 transaction failed 29189/-22, size 0-0 line 3119 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 804.236700] binder: 16411:16412 transaction failed 29189/-22, size 0-0 line 3119 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 804.288833] binder: 16426:16432 transaction failed 29189/-22, size 0-0 line 3119 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 804.337791] binder: 16438:16443 transaction failed 29189/-22, size 0-0 line 3119 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 804.418368] binder: 16461:16466 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 7 printk messages dropped ** [ 804.512403] binder: 16485:16493 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 7 printk messages dropped ** [ 804.570527] binder: 16502:16507 transaction failed 29189/-22, size 0-0 line 3119 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 3 printk messages dropped ** [ 804.632594] binder: 16522:16525 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 804.676206] binder: 16534:16539 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 804.732783] binder: 16550:16554 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 804.799967] binder: 16564:16574 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 804.876405] binder: 16582:16591 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 7 printk messages dropped ** [ 804.963708] binder: 16603:16613 transaction failed 29189/-22, size 0-0 line 3119 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 804.996501] binder: 16607:16615 Acquire 1 refcount change on invalid ref 0 ret -22 ** 4 printk messages dropped ** [ 805.042620] binder: 16626:16632 transaction failed 29189/-22, size 0-0 line 3119 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 805.056530] binder: 16628:16637 Acquire 1 refcount change on invalid ref 0 ret -22 ** 4 printk messages dropped ** [ 805.105756] binder: 16639:16645 transaction failed 29189/-22, size 0-0 line 3119 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 1 printk messages dropped ** [ 805.141371] binder: 16653:16656 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 805.141486] binder: 16653:16656 Release 1 refcount change on invalid ref 0 ret -22 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 2 printk messages dropped ** [ 805.141614] binder: 16647:16652 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 7 printk messages dropped ** [ 805.269607] binder: 16686:16689 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 805.269729] binder: 16686:16689 Release 1 refcount change on invalid ref 0 ret -22 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 4 printk messages dropped ** [ 805.306180] binder: 16696:16702 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 805.306312] binder: 16696:16702 transaction failed 29189/-22, size 0-0 line 3119 ** 5 printk messages dropped ** [ 805.398190] binder: 16717:16725 transaction failed 29189/-22, size 0-0 line 3119 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 805.452980] binder: 16723:16730 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 3 printk messages dropped ** [ 805.526797] binder: 16739:16748 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 7 printk messages dropped ** [ 805.589716] binder: 16754:16761 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 805.659657] binder: 16776:16779 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 9 printk messages dropped ** [ 805.746257] binder: 16793:16800 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 805.817708] binder: 16816:16820 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 1 printk messages dropped ** [ 805.857951] binder: 16825:16831 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 11 printk messages dropped ** [ 805.984732] binder: 16850:16859 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 3 printk messages dropped ** [ 806.038254] binder: 16868:16874 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 1 printk messages dropped ** [ 806.038574] binder: 16870:16873 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 806.108599] binder: 16884:16891 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 806.165365] binder: 16904:16909 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 806.232324] binder: 16918:16927 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 806.307908] binder: 16936:16943 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 806.356648] binder: 16952:16960 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 806.405308] binder: 16965:16971 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 806.468902] binder: 16982:16987 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 806.529539] binder: 16994:17003 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 806.589147] binder: 17011:17017 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 806.651883] binder: 17024:17029 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 806.720319] binder: 17044:17050 transaction failed 29189/-22, size 0-0 line 3119 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 806.798905] binder: 17059:17069 transaction failed 29189/-22, size 0-0 line 3119 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 806.817671] binder: 17072:17075 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 4 printk messages dropped ** [ 806.875744] binder: 17080:17088 transaction failed 29189/-22, size 0-0 line 3119 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 806.934724] binder: 17098:17104 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 806.994432] binder: 17116:17121 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 806.994560] binder: 17116:17121 Release 1 refcount change on invalid ref 0 ret -22 [ 806.994573] binder: 17116:17121 transaction failed 29189/-22, size 0-0 line 3119 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 807.031890] binder: 17128:17131 Acquire 1 refcount change on invalid ref 0 ret -22 [ 807.031904] binder: 17128:17131 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 807.032029] binder: 17128:17131 Release 1 refcount change on invalid ref 0 ret -22 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 807.032043] binder: 17128:17131 transaction failed 29189/-22, size 0-0 line 3119 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 807.042260] binder: 17124:17129 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 4 printk messages dropped ** [ 807.093332] binder: 17139:17147 transaction failed 29189/-22, size 0-0 line 3119 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 807.145648] binder: 17156:17160 transaction failed 29189/-22, size 0-0 line 3119 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 9 printk messages dropped ** [ 807.274322] binder: 17187:17189 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 7 printk messages dropped ** [ 807.340543] binder: 17207:17211 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 807.417587] binder: 17220:17226 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 807.494771] binder: 17237:17244 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 7 printk messages dropped ** [ 807.571280] binder: 17260:17267 transaction failed 29189/-22, size 0-0 line 3119 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 807.640542] binder: 17279:17286 transaction failed 29189/-22, size 0-0 line 3119 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 9 printk messages dropped ** [ 807.786489] binder: 17320:17325 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 807.837860] binder: 17334:17338 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 9 printk messages dropped ** [ 807.921590] binder: 17355:17359 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 807.983045] binder: 17370:17376 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 7 printk messages dropped ** [ 808.044448] binder: 17391:17393 transaction failed 29189/-22, size 0-0 line 3119 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 808.132615] binder: 17410:17414 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 808.156746] binder: 17419:17424 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 7 printk messages dropped ** [ 808.218843] binder: 17434:17442 transaction failed 29189/-22, size 0-0 line 3119 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 7 printk messages dropped ** [ 808.320703] binder: 17462:17466 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 5 printk messages dropped ** [ 808.379775] binder: 17476:17483 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 808.382834] binder: 17475:17480 transaction failed 29189/-22, size 0-0 line 3119 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 1 printk messages dropped ** [ 808.451179] binder: 17493:17499 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 9 printk messages dropped ** [ 808.520287] binder: 17509:17516 transaction failed 29189/-22, size 0-0 line 3119 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 1 printk messages dropped ** [ 808.551529] binder: 17522:17525 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 808.597852] binder: 17534:17539 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 808.656058] binder: 17544:17552 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 3 printk messages dropped ** [ 808.680653] binder: 17554:17558 transaction failed 29189/-22, size 0-0 line 3119 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 808.756675] binder: 17573:17581 transaction failed 29189/-22, size 0-0 line 3119 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 808.820825] binder: 17587:17593 transaction failed 29189/-22, size 0-0 line 3119 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 808.855701] binder: 17603:17608 transaction failed 29189/-22, size 0-0 line 3119 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 808.908684] binder: 17612:17619 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 808.969782] binder: 17629:17636 Acquire 1 refcount change on invalid ref 0 ret -22 ** 4 printk messages dropped ** [ 808.981680] binder: 17633:17638 transaction failed 29189/-22, size 0-0 line 3119 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 1 printk messages dropped ** [ 809.053908] binder: 17644:17657 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 809.107520] binder: 17665:17672 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 809.150749] binder: 17670:17678 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 4 printk messages dropped ** [ 809.169892] binder: 17679:17687 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 3 printk messages dropped ** [ 809.202772] binder: 17690:17692 transaction failed 29189/-22, size 0-0 line 3119 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 7 printk messages dropped ** [ 809.292214] binder: 17717:17720 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 809.384696] binder: 17732:17742 transaction failed 29189/-22, size 0-0 line 3119 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 7 printk messages dropped ** [ 809.464014] binder: 17758:17761 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 809.530466] binder: 17772:17779 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 3 printk messages dropped ** [ 809.569391] binder: 17784:17787 transaction failed 29189/-22, size 0-0 line 3119 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 809.624096] binder: 17798:17802 transaction failed 29189/-22, size 0-0 line 3119 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 809.674806] binder: 17815:17818 transaction failed 29189/-22, size 0-0 line 3119 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 809.737452] binder: 17826:17834 transaction failed 29189/-22, size 0-0 line 3119 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 809.803866] binder: 17846:17851 transaction failed 29189/-22, size 0-0 line 3119 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 809.868589] binder: 17864:17870 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 809.909802] binder: 17875:17880 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 7 printk messages dropped ** [ 809.977068] binder: 17894:17898 transaction failed 29189/-22, size 0-0 line 3119 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 3 printk messages dropped ** [ 810.038273] binder: 17904:17915 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 810.094353] binder: 17922:17929 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 3 printk messages dropped ** [ 810.147179] binder: 17932:17936 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 1 printk messages dropped ** [ 810.148039] binder: 17941:17943 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 810.218239] binder: 17953:17955 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 810.263682] binder: 17967:17971 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 1 printk messages dropped ** [ 810.298132] binder: 17973:17978 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 810.298242] binder: 17973:17978 Release 1 refcount change on invalid ref 0 ret -22 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 4 printk messages dropped ** [ 810.347988] binder: 17989:17992 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 810.384098] binder: 17999:18002 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 810.438310] binder: 18013:18018 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 1 printk messages dropped ** [ 810.501527] binder: 18025:18033 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 810.571317] binder: 18047:18052 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 810.574390] binder: 18040:18053 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 4 printk messages dropped ** [ 810.609016] binder: 18057:18061 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 810.665638] binder: 18065:18071 transaction failed 29189/-22, size 0-0 line 3119 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 810.748070] binder: 18086:18096 transaction failed 29189/-22, size 0-0 line 3119 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 11 printk messages dropped ** [ 810.864673] binder: 18127:18131 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 810.900837] binder: 18138:18144 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 810.966800] binder: 18151:18160 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 811.013296] binder: 18170:18173 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 811.077113] binder: 18185:18189 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 811.140320] binder: 18204:18207 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 811.198389] binder: 18217:18221 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 811.273498] binder: 18238:18243 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 811.308110] binder: 18248:18252 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 811.360221] binder: 18261:18265 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 811.422083] binder: 18276:18280 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 811.477821] binder: 18287:18294 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 811.477834] binder: 18287:18294 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 811.498830] binder: 18288:18296 transaction failed 29189/-22, size 0-0 line 3119 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 811.548331] binder: 18310:18314 transaction failed 29189/-22, size 0-0 line 3119 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 811.602798] binder: 18322:18325 transaction failed 29189/-22, size 0-0 line 3119 ** 3 printk messages dropped ** [ 811.664617] binder: 18338:18344 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 7 printk messages dropped ** [ 811.742586] binder: 18353:18362 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 811.811121] binder: 18376:18381 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 811.844540] binder: 18385:18389 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 811.882980] binder: 18390:18394 transaction failed 29189/-22, size 0-0 line 3119 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 811.926249] binder: 18410:18412 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:02 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:02 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 811.984978] binder: 18420:18429 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 812.056218] binder: 18437:18445 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:02 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 812.083770] binder: 18442:18453 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 812.126235] binder: 18461:18463 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:02 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:02 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 812.199089] binder: 18471:18479 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:02 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:02 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 812.267445] binder: 18494:18497 transaction failed 29189/-22, size 0-0 line 3119 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 812.342991] binder: 18511:18517 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:02 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:02 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 812.405039] binder: 18526:18534 transaction failed 29189/-22, size 0-0 line 3119 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 812.450059] binder: 18537:18540 transaction failed 29189/-22, size 0-0 line 3119 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 812.527116] binder: 18555:18556 transaction failed 29189/-22, size 0-0 line 3119 ** 5 printk messages dropped ** [ 812.589835] binder: 18571:18576 transaction failed 29189/-22, size 0-0 line 3119 [ 812.590986] binder: 18573:18577 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.590998] binder: 18573:18577 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.644617] binder: 18585:18590 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.644631] binder: 18585:18590 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.650288] binder: 18584:18592 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.650300] binder: 18584:18592 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.650417] binder: 18584:18592 Release 1 refcount change on invalid ref 0 ret -22 [ 812.650430] binder: 18584:18592 transaction failed 29189/-22, size 0-0 line 3119 [ 812.702166] binder: 18600:18603 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.702178] binder: 18600:18603 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.704770] binder: 18602:18604 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.704782] binder: 18602:18604 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.705120] binder: 18602:18604 Release 1 refcount change on invalid ref 0 ret -22 [ 812.705134] binder: 18602:18604 transaction failed 29189/-22, size 0-0 line 3119 [ 812.739375] binder: 18611:18616 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.739388] binder: 18611:18616 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.780717] binder: 18624:18627 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.780729] binder: 18624:18627 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.785118] binder: 18615:18621 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.785131] binder: 18615:18621 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.785244] binder: 18615:18621 Release 1 refcount change on invalid ref 0 ret -22 [ 812.785258] binder: 18615:18621 transaction failed 29189/-22, size 0-0 line 3119 [ 812.841507] binder: 18634:18641 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.841520] binder: 18634:18641 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.841648] binder: 18634:18641 Release 1 refcount change on invalid ref 0 ret -22 [ 812.841662] binder: 18634:18641 transaction failed 29189/-22, size 0-0 line 3119 [ 812.868097] binder: 18637:18644 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.868110] binder: 18637:18644 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.901691] binder: 18648:18651 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.901704] binder: 18648:18651 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.902255] binder: 18648:18651 Release 1 refcount change on invalid ref 0 ret -22 [ 812.902268] binder: 18648:18651 transaction failed 29189/-22, size 0-0 line 3119 [ 812.943925] binder: 18655:18660 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.943938] binder: 18655:18660 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.978963] binder: 18673:18675 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.978976] binder: 18673:18675 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.000363] binder: 18667:18676 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.000376] binder: 18667:18676 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.003977] binder: 18667:18676 Release 1 refcount change on invalid ref 0 ret -22 [ 813.003990] binder: 18667:18676 transaction failed 29189/-22, size 0-0 line 3119 [ 813.041723] binder: 18688:18693 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.041737] binder: 18688:18693 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.041858] binder: 18688:18693 Release 1 refcount change on invalid ref 0 ret -22 [ 813.041870] binder: 18688:18693 transaction failed 29189/-22, size 0-0 line 3119 [ 813.044637] binder: 18682:18686 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.044651] binder: 18682:18686 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.087376] binder: 18697:18704 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.087388] binder: 18697:18704 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.087511] binder: 18697:18704 Release 1 refcount change on invalid ref 0 ret -22 [ 813.087524] binder: 18697:18704 transaction failed 29189/-22, size 0-0 line 3119 [ 813.112780] binder: 18701:18705 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.112793] binder: 18701:18705 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.126572] binder: 18708:18714 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.126584] binder: 18708:18714 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.126812] binder: 18708:18714 Release 1 refcount change on invalid ref 0 ret -22 [ 813.126825] binder: 18708:18714 transaction failed 29189/-22, size 0-0 line 3119 [ 813.199484] binder: 18724:18730 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.199504] binder: 18724:18730 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.206811] binder: 18724:18730 Release 1 refcount change on invalid ref 0 ret -22 [ 813.206827] binder: 18724:18730 transaction failed 29189/-22, size 0-0 line 3119 [ 813.208016] binder: 18726:18733 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.208029] binder: 18726:18733 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.257841] binder: 18743:18747 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.257854] binder: 18743:18747 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.258000] binder: 18743:18747 Release 1 refcount change on invalid ref 0 ret -22 [ 813.258014] binder: 18743:18747 transaction failed 29189/-22, size 0-0 line 3119 [ 813.261504] binder: 18746:18750 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.261516] binder: 18746:18750 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.310251] binder: 18756:18763 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.310264] binder: 18756:18763 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.311271] binder: 18756:18763 Release 1 refcount change on invalid ref 0 ret -22 [ 813.311283] binder: 18756:18763 transaction failed 29189/-22, size 0-0 line 3119 [ 813.327079] binder: 18755:18761 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.327092] binder: 18755:18761 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.372966] binder: 18771:18773 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.372978] binder: 18771:18773 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.377836] binder: 18770:18777 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.377848] binder: 18770:18777 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.377973] binder: 18770:18777 Release 1 refcount change on invalid ref 0 ret -22 [ 813.377998] binder: 18770:18777 transaction failed 29189/-22, size 0-0 line 3119 [ 813.431930] binder: 18783:18792 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.431944] binder: 18783:18792 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.436501] binder: 18788:18793 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.436514] binder: 18788:18793 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.437594] binder: 18788:18793 Release 1 refcount change on invalid ref 0 ret -22 [ 813.437607] binder: 18788:18793 transaction failed 29189/-22, size 0-0 line 3119 [ 813.489733] binder: 18800:18801 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.489746] binder: 18800:18801 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.495655] binder: 18802:18810 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.495667] binder: 18802:18810 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.495782] binder: 18802:18810 Release 1 refcount change on invalid ref 0 ret -22 [ 813.495796] binder: 18802:18810 transaction failed 29189/-22, size 0-0 line 3119 [ 813.545455] binder: 18816:18817 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.545468] binder: 18816:18817 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.582052] binder: 18820:18829 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.582066] binder: 18820:18829 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.583227] binder: 18820:18829 Release 1 refcount change on invalid ref 0 ret -22 [ 813.583241] binder: 18820:18829 transaction failed 29189/-22, size 0-0 line 3119 [ 813.640255] binder: 18827:18835 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.640269] binder: 18827:18835 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.649540] binder: 18842:18844 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.649553] binder: 18842:18844 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.668528] binder: 18842:18844 Release 1 refcount change on invalid ref 0 ret -22 [ 813.668542] binder: 18842:18844 transaction failed 29189/-22, size 0-0 line 3119 [ 813.691272] binder: 18850:18854 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.691286] binder: 18850:18854 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.707334] binder: 18855:18861 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.707345] binder: 18855:18861 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.707522] binder: 18855:18861 Release 1 refcount change on invalid ref 0 ret -22 [ 813.707535] binder: 18855:18861 transaction failed 29189/-22, size 0-0 line 3119 [ 813.737369] binder: 18862:18866 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.737381] binder: 18862:18866 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.758806] binder: 18869:18872 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.758818] binder: 18869:18872 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.759060] binder: 18869:18872 Release 1 refcount change on invalid ref 0 ret -22 [ 813.759074] binder: 18869:18872 transaction failed 29189/-22, size 0-0 line 3119 [ 813.793573] binder: 18878:18882 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.793586] binder: 18878:18882 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.827592] binder: 18886:18891 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.827604] binder: 18886:18891 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.827712] binder: 18886:18891 Release 1 refcount change on invalid ref 0 ret -22 [ 813.827724] binder: 18886:18891 transaction failed 29189/-22, size 0-0 line 3119 [ 813.834755] binder: 18890:18893 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.834768] binder: 18890:18893 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.901535] binder: 18901:18908 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.901548] binder: 18901:18908 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.901659] binder: 18901:18908 Release 1 refcount change on invalid ref 0 ret -22 [ 813.901672] binder: 18901:18908 transaction failed 29189/-22, size 0-0 line 3119 [ 813.915267] binder: 18904:18910 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.915280] binder: 18904:18910 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.956630] binder: 18915:18920 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.956644] binder: 18915:18920 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.956765] binder: 18915:18920 Release 1 refcount change on invalid ref 0 ret -22 [ 813.956781] binder: 18915:18920 transaction failed 29189/-22, size 0-0 line 3119 [ 813.975870] binder: 18921:18925 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.975888] binder: 18921:18925 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.035259] binder: 18930:18935 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.035272] binder: 18930:18935 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.035410] binder: 18930:18935 Release 1 refcount change on invalid ref 0 ret -22 [ 814.035424] binder: 18930:18935 transaction failed 29189/-22, size 0-0 line 3119 [ 814.053101] binder: 18936:18940 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.053113] binder: 18936:18940 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.091334] binder: 18948:18952 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.091347] binder: 18948:18952 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.091491] binder: 18948:18952 Release 1 refcount change on invalid ref 0 ret -22 [ 814.091504] binder: 18948:18952 transaction failed 29189/-22, size 0-0 line 3119 [ 814.123015] binder: 18955:18964 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.123030] binder: 18955:18964 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.162204] binder: 18963:18965 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.162217] binder: 18963:18965 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.162335] binder: 18963:18965 Release 1 refcount change on invalid ref 0 ret -22 [ 814.162349] binder: 18963:18965 transaction failed 29189/-22, size 0-0 line 3119 [ 814.200431] binder: 18976:18979 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.200444] binder: 18976:18979 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.321491] binder: 18991:18994 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.321505] binder: 18991:18994 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.321638] binder: 18991:18994 Release 1 refcount change on invalid ref 0 ret -22 [ 814.321651] binder: 18991:18994 transaction failed 29189/-22, size 0-0 line 3119 [ 814.333198] binder: 18989:18996 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.333212] binder: 18989:18996 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.372937] binder: 19005:19011 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.372950] binder: 19005:19011 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.373076] binder: 19005:19011 Release 1 refcount change on invalid ref 0 ret -22 [ 814.373090] binder: 19005:19011 transaction failed 29189/-22, size 0-0 line 3119 [ 814.421331] binder: 19016:19020 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.421344] binder: 19016:19020 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.439263] binder: 19017:19022 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.439276] binder: 19017:19022 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.439413] binder: 19017:19022 Release 1 refcount change on invalid ref 0 ret -22 [ 814.439426] binder: 19017:19022 transaction failed 29189/-22, size 0-0 line 3119 [ 814.474511] binder: 19028:19035 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.474527] binder: 19028:19035 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.494533] binder: 19037:19039 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.494546] binder: 19037:19039 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.494673] binder: 19037:19039 Release 1 refcount change on invalid ref 0 ret -22 [ 814.494688] binder: 19037:19039 transaction failed 29189/-22, size 0-0 line 3119 [ 814.518747] binder: 19041:19045 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.518761] binder: 19041:19045 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.554475] binder: 19050:19051 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.554489] binder: 19050:19051 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.583423] binder: 19054:19058 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.583435] binder: 19054:19058 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.583552] binder: 19054:19058 Release 1 refcount change on invalid ref 0 ret -22 [ 814.583565] binder: 19054:19058 transaction failed 29189/-22, size 0-0 line 3119 [ 814.584656] binder: 19055:19061 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.584668] binder: 19055:19061 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.625363] binder: 19067:19070 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.625377] binder: 19067:19070 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.653039] binder: 19071:19078 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.653054] binder: 19071:19078 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.654068] binder: 19071:19078 Release 1 refcount change on invalid ref 0 ret -22 [ 814.654081] binder: 19071:19078 transaction failed 29189/-22, size 0-0 line 3119 [ 814.700835] binder: 19081:19088 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.700849] binder: 19081:19088 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.730218] binder: 19086:19094 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.730233] binder: 19086:19094 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.730381] binder: 19086:19094 Release 1 refcount change on invalid ref 0 ret -22 [ 814.730396] binder: 19086:19094 transaction failed 29189/-22, size 0-0 line 3119 [ 814.766012] binder: 19100:19103 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.766026] binder: 19100:19103 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.766161] binder: 19100:19103 Release 1 refcount change on invalid ref 0 ret -22 [ 814.766175] binder: 19100:19103 transaction failed 29189/-22, size 0-0 line 3119 [ 814.773927] binder: 19098:19106 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.773941] binder: 19098:19106 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.819374] binder: 19114:19119 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.819386] binder: 19114:19119 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.826009] binder: 19114:19119 Release 1 refcount change on invalid ref 0 ret -22 [ 814.826024] binder: 19114:19119 transaction failed 29189/-22, size 0-0 line 3119 [ 814.848623] binder: 19115:19122 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.848636] binder: 19115:19122 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.881544] binder: 19130:19134 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.881558] binder: 19130:19134 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.881681] binder: 19130:19134 Release 1 refcount change on invalid ref 0 ret -22 [ 814.881694] binder: 19130:19134 transaction failed 29189/-22, size 0-0 line 3119 [ 814.916010] binder: 19135:19142 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.916023] binder: 19135:19142 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.946812] binder: 19139:19148 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.946825] binder: 19139:19148 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.947022] binder: 19139:19148 Release 1 refcount change on invalid ref 0 ret -22 [ 814.947035] binder: 19139:19148 transaction failed 29189/-22, size 0-0 line 3119 [ 814.990597] binder: 19152:19156 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.990610] binder: 19152:19156 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.042207] binder: 19164:19170 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.042220] binder: 19164:19170 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.042342] binder: 19164:19170 Release 1 refcount change on invalid ref 0 ret -22 [ 815.042355] binder: 19164:19170 transaction failed 29189/-22, size 0-0 line 3119 [ 815.047558] binder: 19166:19174 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.049959] binder: 19166:19174 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.096563] binder: 19180:19185 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.096576] binder: 19180:19185 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.103157] binder: 19179:19186 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.103171] binder: 19179:19186 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.103468] binder: 19179:19186 Release 1 refcount change on invalid ref 0 ret -22 [ 815.103482] binder: 19179:19186 transaction failed 29189/-22, size 0-0 line 3119 [ 815.159521] binder: 19192:19198 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.159535] binder: 19192:19198 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.163558] binder: 19196:19199 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.163569] binder: 19196:19199 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.163685] binder: 19196:19199 Release 1 refcount change on invalid ref 0 ret -22 [ 815.163699] binder: 19196:19199 transaction failed 29189/-22, size 0-0 line 3119 [ 815.221155] binder: 19208:19213 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.221169] binder: 19208:19213 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.221291] binder: 19208:19213 Release 1 refcount change on invalid ref 0 ret -22 [ 815.221304] binder: 19208:19213 transaction failed 29189/-22, size 0-0 line 3119 [ 815.232860] binder: 19212:19217 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.232873] binder: 19212:19217 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.288009] binder: 19226:19232 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.288021] binder: 19226:19232 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.288214] binder: 19226:19232 Release 1 refcount change on invalid ref 0 ret -22 [ 815.288226] binder: 19226:19232 transaction failed 29189/-22, size 0-0 line 3119 [ 815.294646] binder: 19229:19235 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.294659] binder: 19229:19235 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.349002] binder: 19238:19246 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.349015] binder: 19238:19246 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.349135] binder: 19238:19246 Release 1 refcount change on invalid ref 0 ret -22 [ 815.349148] binder: 19238:19246 transaction failed 29189/-22, size 0-0 line 3119 [ 815.350983] binder: 19241:19247 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.350995] binder: 19241:19247 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.402581] binder: 19253:19260 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.402594] binder: 19253:19260 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.405804] binder: 19257:19261 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.405818] binder: 19257:19261 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.405929] binder: 19257:19261 Release 1 refcount change on invalid ref 0 ret -22 [ 815.405943] binder: 19257:19261 transaction failed 29189/-22, size 0-0 line 3119 [ 815.464951] binder: 19270:19276 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.464966] binder: 19270:19276 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.483439] binder: 19274:19278 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.483459] binder: 19274:19278 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.506693] binder: 19274:19278 Release 1 refcount change on invalid ref 0 ret -22 [ 815.506712] binder: 19274:19278 transaction failed 29189/-22, size 0-0 line 3119 [ 815.517687] binder: 19281:19282 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.517701] binder: 19281:19282 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.574989] binder: 19293:19296 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.575003] binder: 19293:19296 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.575150] binder: 19293:19296 Release 1 refcount change on invalid ref 0 ret -22 [ 815.575165] binder: 19293:19296 transaction failed 29189/-22, size 0-0 line 3119 [ 815.592999] binder: 19294:19301 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.593013] binder: 19294:19301 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.639652] binder: 19308:19316 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.639664] binder: 19308:19316 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.639791] binder: 19308:19316 Release 1 refcount change on invalid ref 0 ret -22 [ 815.639803] binder: 19308:19316 transaction failed 29189/-22, size 0-0 line 3119 [ 815.657491] binder: 19312:19320 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.657502] binder: 19312:19320 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.700231] binder: 19321:19323 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.700243] binder: 19321:19323 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.700365] binder: 19321:19323 Release 1 refcount change on invalid ref 0 ret -22 [ 815.700387] binder: 19321:19323 transaction failed 29189/-22, size 0-0 line 3119 [ 815.722496] binder: 19327:19334 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.722508] binder: 19327:19334 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.763997] binder: 19337:19342 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.764011] binder: 19337:19342 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.765075] binder: 19337:19342 Release 1 refcount change on invalid ref 0 ret -22 [ 815.765090] binder: 19337:19342 transaction failed 29189/-22, size 0-0 line 3119 [ 815.783981] binder: 19345:19349 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.783994] binder: 19345:19349 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.801075] binder: 19352:19355 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.801088] binder: 19352:19355 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.813219] binder: 19352:19355 Release 1 refcount change on invalid ref 0 ret -22 [ 815.813233] binder: 19352:19355 transaction failed 29189/-22, size 0-0 line 3119 [ 815.852693] binder: 19359:19368 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.852706] binder: 19359:19368 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.859853] binder: 19366:19370 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.859866] binder: 19366:19370 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.860000] binder: 19366:19370 Release 1 refcount change on invalid ref 0 ret -22 [ 815.860013] binder: 19366:19370 transaction failed 29189/-22, size 0-0 line 3119 [ 815.899128] binder: 19371:19381 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.899141] binder: 19371:19381 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.935580] binder: 19376:19384 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.936271] binder: 19376:19384 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.936597] binder: 19376:19384 Release 1 refcount change on invalid ref 0 ret -22 [ 815.936611] binder: 19376:19384 transaction failed 29189/-22, size 0-0 line 3119 [ 815.971004] binder: 19390:19399 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.971017] binder: 19390:19399 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.003551] binder: 19396:19401 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.003565] binder: 19396:19401 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.003686] binder: 19396:19401 Release 1 refcount change on invalid ref 0 ret -22 [ 816.003699] binder: 19396:19401 transaction failed 29189/-22, size 0-0 line 3119 [ 816.038582] binder: 19407:19411 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.038596] binder: 19407:19411 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.067952] binder: 19413:19418 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.067966] binder: 19413:19418 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.068089] binder: 19413:19418 Release 1 refcount change on invalid ref 0 ret -22 [ 816.068102] binder: 19413:19418 transaction failed 29189/-22, size 0-0 line 3119 [ 816.097730] binder: 19423:19429 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.097742] binder: 19423:19429 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.115260] binder: 19425:19433 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.115274] binder: 19425:19433 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.115408] binder: 19425:19433 Release 1 refcount change on invalid ref 0 ret -22 [ 816.115421] binder: 19425:19433 transaction failed 29189/-22, size 0-0 line 3119 [ 816.178081] binder: 19439:19448 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.178095] binder: 19439:19448 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.190539] binder: 19446:19453 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.190552] binder: 19446:19453 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.191205] binder: 19446:19453 Release 1 refcount change on invalid ref 0 ret -22 [ 816.191219] binder: 19446:19453 transaction failed 29189/-22, size 0-0 line 3119 [ 816.241448] binder: 19459:19467 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.241462] binder: 19459:19467 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.275741] binder: 19461:19471 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.275755] binder: 19461:19471 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.279342] binder: 19461:19471 Release 1 refcount change on invalid ref 0 ret -22 [ 816.279355] binder: 19461:19471 transaction failed 29189/-22, size 0-0 line 3119 [ 816.304223] binder: 19470:19477 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.304236] binder: 19470:19477 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.331990] binder: 19479:19487 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.332004] binder: 19479:19487 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.332114] binder: 19479:19487 Release 1 refcount change on invalid ref 0 ret -22 [ 816.332127] binder: 19479:19487 transaction failed 29189/-22, size 0-0 line 3119 [ 816.349893] binder: 19488:19493 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.350920] binder: 19488:19493 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.363381] binder: 19494:19495 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.363392] binder: 19494:19495 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.363480] binder: 19494:19495 Release 1 refcount change on invalid ref 0 ret -22 [ 816.363498] binder: 19494:19495 transaction failed 29189/-22, size 0-0 line 3119 [ 816.428087] binder: 19504:19512 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.428100] binder: 19504:19512 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.431580] binder: 19505:19509 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.431592] binder: 19505:19509 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.432620] binder: 19505:19509 Release 1 refcount change on invalid ref 0 ret -22 [ 816.432633] binder: 19505:19509 transaction failed 29189/-22, size 0-0 line 3119 [ 816.488147] binder: 19517:19526 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.488161] binder: 19517:19526 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.500805] binder: 19523:19529 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.500818] binder: 19523:19529 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.500941] binder: 19523:19529 Release 1 refcount change on invalid ref 0 ret -22 [ 816.500954] binder: 19523:19529 transaction failed 29189/-22, size 0-0 line 3119 [ 816.530647] binder: 19533:19538 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.530660] binder: 19533:19538 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.582414] binder: 19540:19548 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.582426] binder: 19540:19548 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.582538] binder: 19540:19548 Release 1 refcount change on invalid ref 0 ret -22 [ 816.582551] binder: 19540:19548 transaction failed 29189/-22, size 0-0 line 3119 [ 816.588167] binder: 19547:19550 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.588180] binder: 19547:19550 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.639124] binder: 19558:19562 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.639137] binder: 19558:19562 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.644254] binder: 19555:19564 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.644265] binder: 19555:19564 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.650001] binder: 19555:19564 Release 1 refcount change on invalid ref 0 ret -22 [ 816.650016] binder: 19555:19564 transaction failed 29189/-22, size 0-0 line 3119 [ 816.689804] binder: 19573:19578 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.689818] binder: 19573:19578 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.726997] binder: 19572:19580 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.727010] binder: 19572:19580 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.727137] binder: 19572:19580 Release 1 refcount change on invalid ref 0 ret -22 [ 816.727151] binder: 19572:19580 transaction failed 29189/-22, size 0-0 line 3119 [ 816.749661] binder: 19583:19588 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.749674] binder: 19583:19588 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.785222] binder: 19591:19597 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.785237] binder: 19591:19597 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.785366] binder: 19591:19597 Release 1 refcount change on invalid ref 0 ret -22 [ 816.785379] binder: 19591:19597 transaction failed 29189/-22, size 0-0 line 3119 [ 816.803325] binder: 19598:19606 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.803340] binder: 19598:19606 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.853432] binder: 19611:19614 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.853447] binder: 19611:19614 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.853597] binder: 19611:19614 Release 1 refcount change on invalid ref 0 ret -22 [ 816.853611] binder: 19611:19614 transaction failed 29189/-22, size 0-0 line 3119 [ 816.866431] binder: 19616:19623 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.866447] binder: 19616:19623 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.943525] binder: 19628:19634 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.943541] binder: 19628:19634 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.946502] binder: 19626:19633 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.946516] binder: 19626:19633 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.946639] binder: 19626:19633 Release 1 refcount change on invalid ref 0 ret -22 [ 816.946653] binder: 19626:19633 transaction failed 29189/-22, size 0-0 line 3119 [ 817.021550] binder: 19649:19657 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.021563] binder: 19649:19657 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.032832] binder: 19651:19661 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.032843] binder: 19651:19661 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.033517] binder: 19651:19661 Release 1 refcount change on invalid ref 0 ret -22 [ 817.033531] binder: 19651:19661 transaction failed 29189/-22, size 0-0 line 3119 [ 817.107940] binder: 19670:19677 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.107954] binder: 19670:19677 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.119040] binder: 19674:19679 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.119055] binder: 19674:19679 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.119208] binder: 19674:19679 Release 1 refcount change on invalid ref 0 ret -22 [ 817.119220] binder: 19674:19679 transaction failed 29189/-22, size 0-0 line 3119 [ 817.156144] binder: 19684:19688 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.156157] binder: 19684:19688 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.160002] binder: 19686:19687 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.160016] binder: 19686:19687 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.160147] binder: 19686:19687 Release 1 refcount change on invalid ref 0 ret -22 [ 817.160160] binder: 19686:19687 transaction failed 29189/-22, size 0-0 line 3119 [ 817.201736] binder: 19696:19699 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.201749] binder: 19696:19699 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.218282] binder: 19697:19701 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.218296] binder: 19697:19701 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.218986] binder: 19697:19701 Release 1 refcount change on invalid ref 0 ret -22 [ 817.219001] binder: 19697:19701 transaction failed 29189/-22, size 0-0 line 3119 [ 817.254772] binder: 19705:19710 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.254785] binder: 19705:19710 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.283861] binder: 19714:19719 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.283874] binder: 19714:19719 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.294249] binder: 19714:19719 Release 1 refcount change on invalid ref 0 ret -22 [ 817.294264] binder: 19714:19719 transaction failed 29189/-22, size 0-0 line 3119 [ 817.304684] binder: 19721:19726 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.304698] binder: 19721:19726 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.345649] binder: 19733:19737 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.345661] binder: 19733:19737 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.348440] binder: 19733:19737 Release 1 refcount change on invalid ref 0 ret -22 [ 817.348454] binder: 19733:19737 transaction failed 29189/-22, size 0-0 line 3119 [ 817.361390] binder: 19730:19739 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.361460] binder: 19730:19739 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.411760] binder: 19747:19752 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.411773] binder: 19747:19752 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.411884] binder: 19747:19752 Release 1 refcount change on invalid ref 0 ret -22 [ 817.411897] binder: 19747:19752 transaction failed 29189/-22, size 0-0 line 3119 [ 817.420746] binder: 19751:19756 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.420760] binder: 19751:19756 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.475326] binder: 19761:19764 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.475339] binder: 19761:19764 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.475698] binder: 19761:19764 Release 1 refcount change on invalid ref 0 ret -22 [ 817.475718] binder: 19761:19764 transaction failed 29189/-22, size 0-0 line 3119 [ 817.502087] binder: 19765:19772 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.502100] binder: 19765:19772 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.510798] binder: 19774:19779 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.510809] binder: 19774:19779 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.510933] binder: 19774:19779 Release 1 refcount change on invalid ref 0 ret -22 [ 817.510946] binder: 19774:19779 transaction failed 29189/-22, size 0-0 line 3119 [ 817.563312] binder: 19784:19790 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.563324] binder: 19784:19790 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.563495] binder: 19784:19790 Release 1 refcount change on invalid ref 0 ret -22 [ 817.563507] binder: 19784:19790 transaction failed 29189/-22, size 0-0 line 3119 [ 817.572639] binder: 19788:19792 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.572652] binder: 19788:19792 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.628038] binder: 19802:19805 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.628052] binder: 19802:19805 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.628175] binder: 19802:19805 Release 1 refcount change on invalid ref 0 ret -22 [ 817.628188] binder: 19802:19805 transaction failed 29189/-22, size 0-0 line 3119 [ 817.638600] binder: 19799:19804 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.638615] binder: 19799:19804 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.697391] binder: 19818:19820 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.697403] binder: 19818:19820 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.697522] binder: 19818:19820 Release 1 refcount change on invalid ref 0 ret -22 [ 817.697533] binder: 19818:19820 transaction failed 29189/-22, size 0-0 line 3119 [ 817.743687] binder: 19826:19837 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.743836] binder: 19826:19837 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.745473] binder: 19833:19836 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.745488] binder: 19833:19836 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.745917] binder: 19833:19836 Release 1 refcount change on invalid ref 0 ret -22 [ 817.745930] binder: 19833:19836 transaction failed 29189/-22, size 0-0 line 3119 [ 817.823900] binder: 19846:19853 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.823915] binder: 19846:19853 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.825318] binder: 19850:19854 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.825330] binder: 19850:19854 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.825761] binder: 19850:19854 Release 1 refcount change on invalid ref 0 ret -22 [ 817.825776] binder: 19850:19854 transaction failed 29189/-22, size 0-0 line 3119 [ 817.868241] binder: 19857:19865 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.868252] binder: 19857:19865 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.868326] binder: 19860:19864 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.868340] binder: 19860:19864 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.868365] binder: 19857:19865 Release 1 refcount change on invalid ref 0 ret -22 [ 817.868378] binder: 19857:19865 transaction failed 29189/-22, size 0-0 line 3119 [ 817.925156] binder: 19873:19877 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.925170] binder: 19873:19877 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.925290] binder: 19873:19877 Release 1 refcount change on invalid ref 0 ret -22 [ 817.925304] binder: 19873:19877 transaction failed 29189/-22, size 0-0 line 3119 [ 817.936415] binder: 19876:19878 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.936428] binder: 19876:19878 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.984327] binder: 19887:19892 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.984341] binder: 19887:19892 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.984724] binder: 19887:19892 Release 1 refcount change on invalid ref 0 ret -22 [ 817.984737] binder: 19887:19892 transaction failed 29189/-22, size 0-0 line 3119 [ 817.985448] binder: 19889:19893 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.985460] binder: 19889:19893 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.024544] binder: 19900:19906 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.024557] binder: 19900:19906 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.070357] binder: 19899:19908 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.070369] binder: 19899:19908 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.070506] binder: 19899:19908 Release 1 refcount change on invalid ref 0 ret -22 [ 818.070520] binder: 19899:19908 transaction failed 29189/-22, size 0-0 line 3119 [ 818.102759] binder: 19916:19923 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.102772] binder: 19916:19923 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.110148] binder: 19918:19926 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.110161] binder: 19918:19926 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.110298] binder: 19918:19926 Release 1 refcount change on invalid ref 0 ret -22 [ 818.110311] binder: 19918:19926 transaction failed 29189/-22, size 0-0 line 3119 [ 818.155210] binder: 19936:19938 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.155223] binder: 19936:19938 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.181954] binder: 19935:19942 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.181969] binder: 19935:19942 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.182109] binder: 19935:19942 Release 1 refcount change on invalid ref 0 ret -22 [ 818.182123] binder: 19935:19942 transaction failed 29189/-22, size 0-0 line 3119 [ 818.195780] binder: 19944:19946 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.195793] binder: 19944:19946 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.234573] binder: 19948:19956 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.234587] binder: 19948:19956 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.234766] binder: 19948:19956 Release 1 refcount change on invalid ref 0 ret -22 [ 818.234779] binder: 19948:19956 transaction failed 29189/-22, size 0-0 line 3119 [ 818.255680] binder: 19958:19963 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.255899] binder: 19958:19963 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.312553] binder: 19967:19974 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.312567] binder: 19967:19974 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.314747] binder: 19967:19974 Release 1 refcount change on invalid ref 0 ret -22 [ 818.314760] binder: 19967:19974 transaction failed 29189/-22, size 0-0 line 3119 [ 818.329023] binder: 19977:19980 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.329036] binder: 19977:19980 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.374558] binder: 19985:19989 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.374571] binder: 19985:19989 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.376724] binder: 19985:19989 Release 1 refcount change on invalid ref 0 ret -22 [ 818.376737] binder: 19985:19989 transaction failed 29189/-22, size 0-0 line 3119 [ 818.409554] binder: 19992:19998 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.409567] binder: 19992:19998 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.458829] binder: 20000:20009 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.458841] binder: 20000:20009 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.459006] binder: 20003:20008 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.459013] binder: 20000:20009 Release 1 refcount change on invalid ref 0 ret -22 [ 818.459018] binder: 20003:20008 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.459026] binder: 20000:20009 transaction failed 29189/-22, size 0-0 line 3119 [ 818.526253] binder: 20021:20027 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.526269] binder: 20021:20027 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.526635] binder: 20021:20027 Release 1 refcount change on invalid ref 0 ret -22 [ 818.526648] binder: 20021:20027 transaction failed 29189/-22, size 0-0 line 3119 [ 818.528550] binder: 20017:20028 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.528563] binder: 20017:20028 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.611578] binder: 20034:20042 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.611591] binder: 20034:20042 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.615356] binder: 20040:20045 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.615368] binder: 20040:20045 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.616439] binder: 20040:20045 Release 1 refcount change on invalid ref 0 ret -22 [ 818.616452] binder: 20040:20045 transaction failed 29189/-22, size 0-0 line 3119 [ 818.670173] binder: 20051:20059 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.670357] binder: 20051:20059 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.672036] binder: 20052:20060 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.672049] binder: 20052:20060 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.672176] binder: 20052:20060 Release 1 refcount change on invalid ref 0 ret -22 [ 818.672189] binder: 20052:20060 transaction failed 29189/-22, size 0-0 line 3119 [ 818.733666] binder: 20069:20075 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.733679] binder: 20069:20075 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.733784] binder: 20069:20075 Release 1 refcount change on invalid ref 0 ret -22 [ 818.733797] binder: 20069:20075 transaction failed 29189/-22, size 0-0 line 3119 [ 818.764121] binder: 20073:20084 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.764135] binder: 20073:20084 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.799697] binder: 20082:20086 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.799712] binder: 20082:20086 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.799856] binder: 20082:20086 Release 1 refcount change on invalid ref 0 ret -22 [ 818.799869] binder: 20082:20086 transaction failed 29189/-22, size 0-0 line 3119 [ 818.848041] binder: 20097:20102 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.848055] binder: 20097:20102 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.852006] binder: 20101:20105 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.852018] binder: 20101:20105 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.852141] binder: 20101:20105 Release 1 refcount change on invalid ref 0 ret -22 [ 818.852154] binder: 20101:20105 transaction failed 29189/-22, size 0-0 line 3119 [ 818.901075] binder: 20110:20115 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.901089] binder: 20110:20115 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.901214] binder: 20110:20115 Release 1 refcount change on invalid ref 0 ret -22 [ 818.901227] binder: 20110:20115 transaction failed 29189/-22, size 0-0 line 3119 [ 818.904293] binder: 20112:20118 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.904303] binder: 20112:20118 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.950775] binder: 20123:20126 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.950788] binder: 20123:20126 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.951202] binder: 20123:20126 Release 1 refcount change on invalid ref 0 ret -22 [ 818.951215] binder: 20123:20126 transaction failed 29189/-22, size 0-0 line 3119 [ 818.990849] binder: 20129:20139 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.990861] binder: 20129:20139 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.030273] binder: 20140:20144 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.030286] binder: 20140:20144 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.031455] binder: 20140:20144 Release 1 refcount change on invalid ref 0 ret -22 [ 819.031469] binder: 20140:20144 transaction failed 29189/-22, size 0-0 line 3119 [ 819.053612] binder: 20148:20152 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.053625] binder: 20148:20152 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.097598] binder: 20157:20162 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.097612] binder: 20157:20162 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.097742] binder: 20157:20162 Release 1 refcount change on invalid ref 0 ret -22 [ 819.097756] binder: 20157:20162 transaction failed 29189/-22, size 0-0 line 3119 [ 819.126436] binder: 20165:20171 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.126448] binder: 20165:20171 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.149012] binder: 20172:20179 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.149025] binder: 20172:20179 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.149155] binder: 20172:20179 Release 1 refcount change on invalid ref 0 ret -22 [ 819.149168] binder: 20172:20179 transaction failed 29189/-22, size 0-0 line 3119 [ 819.193532] binder: 20180:20184 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.193546] binder: 20180:20184 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.205358] binder: 20190:20193 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.205370] binder: 20190:20193 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.205635] binder: 20190:20193 Release 1 refcount change on invalid ref 0 ret -22 [ 819.205648] binder: 20190:20193 transaction failed 29189/-22, size 0-0 line 3119 [ 819.261914] binder: 20199:20201 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.261928] binder: 20199:20201 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.272789] binder: 20203:20209 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.272802] binder: 20203:20209 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.273180] binder: 20203:20209 Release 1 refcount change on invalid ref 0 ret -22 [ 819.273194] binder: 20203:20209 transaction failed 29189/-22, size 0-0 line 3119 [ 819.308444] binder: 20213:20216 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.308457] binder: 20213:20216 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.344056] binder: 20218:20221 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.344069] binder: 20218:20221 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.344189] binder: 20218:20221 Release 1 refcount change on invalid ref 0 ret -22 [ 819.344203] binder: 20218:20221 transaction failed 29189/-22, size 0-0 line 3119 [ 819.367905] binder: 20225:20227 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.367918] binder: 20225:20227 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.398924] binder: 20232:20238 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.398938] binder: 20232:20238 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.399056] binder: 20232:20238 Release 1 refcount change on invalid ref 0 ret -22 [ 819.399069] binder: 20232:20238 transaction failed 29189/-22, size 0-0 line 3119 [ 819.431415] binder: 20240:20242 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.431428] binder: 20240:20242 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.477505] binder: 20247:20255 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.477518] binder: 20247:20255 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.478609] binder: 20247:20255 Release 1 refcount change on invalid ref 0 ret -22 [ 819.478623] binder: 20247:20255 transaction failed 29189/-22, size 0-0 line 3119 [ 819.484911] binder: 20256:20259 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.484924] binder: 20256:20259 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.538603] binder: 20270:20275 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.538615] binder: 20270:20275 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.539628] binder: 20270:20275 Release 1 refcount change on invalid ref 0 ret -22 [ 819.539643] binder: 20270:20275 transaction failed 29189/-22, size 0-0 line 3119 [ 819.544115] binder: 20265:20266 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.544129] binder: 20265:20266 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.594635] binder: 20279:20284 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.594648] binder: 20279:20284 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.599737] binder: 20280:20287 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.599749] binder: 20280:20287 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.602365] binder: 20280:20287 Release 1 refcount change on invalid ref 0 ret -22 [ 819.602386] binder: 20280:20287 transaction failed 29189/-22, size 0-0 line 3119 [ 819.631994] binder: 20293:20294 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.632008] binder: 20293:20294 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.651306] binder: 20299:20303 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.651319] binder: 20299:20303 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.651448] binder: 20299:20303 Release 1 refcount change on invalid ref 0 ret -22 [ 819.651461] binder: 20299:20303 transaction failed 29189/-22, size 0-0 line 3119 [ 819.694796] binder: 20308:20314 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.694810] binder: 20308:20314 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.712628] binder: 20312:20316 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.712644] binder: 20312:20316 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.712781] binder: 20312:20316 Release 1 refcount change on invalid ref 0 ret -22 [ 819.712795] binder: 20312:20316 transaction failed 29189/-22, size 0-0 line 3119 [ 819.760693] binder: 20322:20327 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.760731] binder: 20322:20327 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.809355] binder: 20332:20335 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.809484] binder: 20332:20335 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.810361] binder: 20332:20335 Release 1 refcount change on invalid ref 0 ret -22 [ 819.810375] binder: 20332:20335 transaction failed 29189/-22, size 0-0 line 3119 [ 819.821287] binder: 20341:20346 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.821301] binder: 20341:20346 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.856335] binder: 20348:20350 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.856349] binder: 20348:20350 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.856474] binder: 20348:20350 Release 1 refcount change on invalid ref 0 ret -22 [ 819.856487] binder: 20348:20350 transaction failed 29189/-22, size 0-0 line 3119 [ 819.899405] binder: 20351:20355 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.899419] binder: 20351:20355 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.919739] binder: 20361:20367 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.919751] binder: 20361:20367 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.920442] binder: 20361:20367 Release 1 refcount change on invalid ref 0 ret -22 [ 819.920456] binder: 20361:20367 transaction failed 29189/-22, size 0-0 line 3119 [ 819.930219] binder: 20369:20372 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.930232] binder: 20369:20372 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.973698] binder: 20377:20382 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.973709] binder: 20377:20382 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.973823] binder: 20377:20382 Release 1 refcount change on invalid ref 0 ret -22 [ 819.973835] binder: 20377:20382 transaction failed 29189/-22, size 0-0 line 3119 [ 819.990419] binder: 20381:20384 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.990432] binder: 20381:20384 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.026422] binder: 20394:20396 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.026436] binder: 20394:20396 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.026572] binder: 20394:20396 Release 1 refcount change on invalid ref 0 ret -22 [ 820.026584] binder: 20394:20396 transaction failed 29189/-22, size 0-0 line 3119 [ 820.058564] binder: 20399:20408 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.062084] binder: 20399:20408 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.087917] binder: 20409:20412 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.087930] binder: 20409:20412 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.088358] binder: 20409:20412 Release 1 refcount change on invalid ref 0 ret -22 [ 820.088372] binder: 20409:20412 transaction failed 29189/-22, size 0-0 line 3119 [ 820.098874] binder: 20411:20415 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.098887] binder: 20411:20415 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.156700] binder: 20421:20426 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.156714] binder: 20421:20426 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.162005] binder: 20419:20427 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.162018] binder: 20419:20427 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.162151] binder: 20419:20427 Release 1 refcount change on invalid ref 0 ret -22 [ 820.162165] binder: 20419:20427 transaction failed 29189/-22, size 0-0 line 3119 [ 820.228035] binder: 20436:20439 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.228048] binder: 20436:20439 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.233037] binder: 20435:20440 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.233050] binder: 20435:20440 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.233182] binder: 20435:20440 Release 1 refcount change on invalid ref 0 ret -22 [ 820.233196] binder: 20435:20440 transaction failed 29189/-22, size 0-0 line 3119 [ 820.276224] binder: 20447:20455 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.276236] binder: 20447:20455 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.295629] binder: 20453:20456 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.295643] binder: 20453:20456 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.296476] binder: 20453:20456 Release 1 refcount change on invalid ref 0 ret -22 [ 820.296491] binder: 20453:20456 transaction failed 29189/-22, size 0-0 line 3119 [ 820.367831] binder: 20468:20473 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.367843] binder: 20468:20473 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.367992] binder: 20468:20473 Release 1 refcount change on invalid ref 0 ret -22 [ 820.368005] binder: 20468:20473 transaction failed 29189/-22, size 0-0 line 3119 [ 820.370491] binder: 20465:20472 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.370504] binder: 20465:20472 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.429370] binder: 20485:20488 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.429393] binder: 20485:20488 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.429524] binder: 20485:20488 Release 1 refcount change on invalid ref 0 ret -22 [ 820.429538] binder: 20485:20488 transaction failed 29189/-22, size 0-0 line 3119 [ 820.451973] binder: 20483:20492 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.451985] binder: 20483:20492 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.482986] binder: 20498:20500 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.483001] binder: 20498:20500 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.483176] binder: 20498:20500 Release 1 refcount change on invalid ref 0 ret -22 [ 820.483190] binder: 20498:20500 transaction failed 29189/-22, size 0-0 line 3119 [ 820.531327] binder: 20505:20512 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.531341] binder: 20505:20512 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.550630] binder: 20514:20517 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.550644] binder: 20514:20517 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.550773] binder: 20514:20517 Release 1 refcount change on invalid ref 0 ret -22 [ 820.550787] binder: 20514:20517 transaction failed 29189/-22, size 0-0 line 3119 [ 820.601491] binder: 20526:20530 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.601504] binder: 20526:20530 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.601642] binder: 20526:20530 Release 1 refcount change on invalid ref 0 ret -22 [ 820.601655] binder: 20526:20530 transaction failed 29189/-22, size 0-0 line 3119 [ 820.609033] binder: 20524:20531 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.609046] binder: 20524:20531 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.651211] binder: 20539:20540 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.651224] binder: 20539:20540 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.651343] binder: 20539:20540 Release 1 refcount change on invalid ref 0 ret -22 [ 820.651356] binder: 20539:20540 transaction failed 29189/-22, size 0-0 line 3119 [ 820.674221] binder: 20542:20546 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.674236] binder: 20542:20546 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.727467] binder: 20552:20557 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.727481] binder: 20552:20557 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.727616] binder: 20552:20557 Release 1 refcount change on invalid ref 0 ret -22 [ 820.727630] binder: 20552:20557 transaction failed 29189/-22, size 0-0 line 3119 [ 820.729407] binder: 20556:20560 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.729420] binder: 20556:20560 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.786507] binder: 20569:20575 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.786521] binder: 20569:20575 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.800122] binder: 20567:20576 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.800136] binder: 20567:20576 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.800370] binder: 20567:20576 Release 1 refcount change on invalid ref 0 ret -22 [ 820.800383] binder: 20567:20576 transaction failed 29189/-22, size 0-0 line 3119 [ 820.853635] binder: 20583:20587 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.853648] binder: 20583:20587 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.854733] binder: 20583:20587 Release 1 refcount change on invalid ref 0 ret -22 [ 820.854746] binder: 20583:20587 transaction failed 29189/-22, size 0-0 line 3119 [ 820.880882] binder: 20588:20594 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.880896] binder: 20588:20594 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.895159] binder: 20598:20599 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.895170] binder: 20598:20599 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.895273] binder: 20598:20599 Release 1 refcount change on invalid ref 0 ret -22 [ 820.895286] binder: 20598:20599 transaction failed 29189/-22, size 0-0 line 3119 [ 820.936343] binder: 20607:20610 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.936356] binder: 20607:20610 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.936482] binder: 20607:20610 Release 1 refcount change on invalid ref 0 ret -22 [ 820.936494] binder: 20607:20610 transaction failed 29189/-22, size 0-0 line 3119 [ 820.989935] binder: 20615:20619 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.990163] binder: 20615:20619 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.027266] binder: 20625:20627 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.027279] binder: 20625:20627 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.028179] binder: 20625:20627 Release 1 refcount change on invalid ref 0 ret -22 [ 821.028192] binder: 20625:20627 transaction failed 29189/-22, size 0-0 line 3119 [ 821.056455] binder: 20630:20637 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.056469] binder: 20630:20637 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.093408] binder: 20641:20644 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.093423] binder: 20641:20644 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.093547] binder: 20641:20644 Release 1 refcount change on invalid ref 0 ret -22 [ 821.093560] binder: 20641:20644 transaction failed 29189/-22, size 0-0 line 3119 [ 821.133133] binder: 20651:20656 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.133147] binder: 20651:20656 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.147903] binder: 20655:20661 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.147916] binder: 20655:20661 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.148046] binder: 20655:20661 Release 1 refcount change on invalid ref 0 ret -22 [ 821.148059] binder: 20655:20661 transaction failed 29189/-22, size 0-0 line 3119 [ 821.199236] binder: 20664:20676 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.199250] binder: 20664:20676 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.225950] binder: 20675:20677 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.225961] binder: 20675:20677 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.226480] binder: 20675:20677 Release 1 refcount change on invalid ref 0 ret -22 [ 821.226495] binder: 20675:20677 transaction failed 29189/-22, size 0-0 line 3119 [ 821.267769] binder: 20685:20692 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.267782] binder: 20685:20692 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.296597] binder: 20690:20698 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.296610] binder: 20690:20698 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.297652] binder: 20690:20698 Release 1 refcount change on invalid ref 0 ret -22 [ 821.297666] binder: 20690:20698 transaction failed 29189/-22, size 0-0 line 3119 [ 821.332307] binder: 20700:20707 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.332321] binder: 20700:20707 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.388009] binder: 20705:20717 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.388025] binder: 20705:20717 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.388738] binder: 20705:20717 Release 1 refcount change on invalid ref 0 ret -22 [ 821.388752] binder: 20705:20717 transaction failed 29189/-22, size 0-0 line 3119 [ 821.402067] binder: 20716:20718 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.402079] binder: 20716:20718 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.465523] binder: 20729:20740 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.465536] binder: 20729:20740 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.465676] binder: 20729:20740 Release 1 refcount change on invalid ref 0 ret -22 [ 821.465688] binder: 20729:20740 transaction failed 29189/-22, size 0-0 line 3119 [ 821.467812] binder: 20736:20741 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.467824] binder: 20736:20741 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.524686] binder: 20747:20751 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.524701] binder: 20747:20751 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.575603] binder: 20755:20760 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.575616] binder: 20755:20760 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.576221] binder: 20755:20760 Release 1 refcount change on invalid ref 0 ret -22 [ 821.576236] binder: 20755:20760 transaction failed 29189/-22, size 0-0 line 3119 [ 821.603074] binder: 20759:20765 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.603087] binder: 20759:20765 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.635780] binder: 20777:20781 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.635794] binder: 20777:20781 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.635916] binder: 20777:20781 Release 1 refcount change on invalid ref 0 ret -22 [ 821.635929] binder: 20777:20781 transaction failed 29189/-22, size 0-0 line 3119 [ 821.674528] binder: 20779:20783 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.674542] binder: 20779:20783 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.722703] binder: 20788:20794 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.722717] binder: 20788:20794 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.724270] binder: 20788:20794 Release 1 refcount change on invalid ref 0 ret -22 [ 821.724284] binder: 20788:20794 transaction failed 29189/-22, size 0-0 line 3119 [ 821.746491] binder: 20796:20799 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.746506] binder: 20796:20799 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.806008] binder: 20806:20810 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.806021] binder: 20806:20810 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.841599] binder: 20812:20817 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.841612] binder: 20812:20817 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.841747] binder: 20812:20817 Release 1 refcount change on invalid ref 0 ret -22 [ 821.841759] binder: 20812:20817 transaction failed 29189/-22, size 0-0 line 3119 [ 821.858262] binder: 20823:20827 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.858276] binder: 20823:20827 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.890970] binder: 20832:20836 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.890982] binder: 20832:20836 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.930746] binder: 20828:20841 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.930760] binder: 20828:20841 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.930887] binder: 20828:20841 Release 1 refcount change on invalid ref 0 ret -22 [ 821.930900] binder: 20828:20841 transaction failed 29189/-22, size 0-0 line 3119 [ 821.952580] binder: 20842:20848 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.952593] binder: 20842:20848 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.993095] binder: 20856:20861 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.993108] binder: 20856:20861 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.993278] binder: 20856:20861 Release 1 refcount change on invalid ref 0 ret -22 [ 821.993291] binder: 20856:20861 transaction failed 29189/-22, size 0-0 line 3119 [ 822.003239] binder: 20859:20863 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.003252] binder: 20859:20863 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.041630] binder: 20867:20872 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.041644] binder: 20867:20872 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.041765] binder: 20867:20872 Release 1 refcount change on invalid ref 0 ret -22 [ 822.041779] binder: 20867:20872 transaction failed 29189/-22, size 0-0 line 3119 [ 822.067275] binder: 20870:20875 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.067298] binder: 20870:20875 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.099455] binder: 20881:20882 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.099470] binder: 20881:20882 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.100279] binder: 20881:20882 Release 1 refcount change on invalid ref 0 ret -22 [ 822.100294] binder: 20881:20882 transaction failed 29189/-22, size 0-0 line 3119 [ 822.130338] binder: 20890:20897 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.130351] binder: 20890:20897 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.133864] binder: 20893:20898 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.133884] binder: 20893:20898 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.134007] binder: 20893:20898 Release 1 refcount change on invalid ref 0 ret -22 [ 822.134020] binder: 20893:20898 transaction failed 29189/-22, size 0-0 line 3119 [ 822.178990] binder: 20900:20904 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.179003] binder: 20900:20904 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.219888] binder: 20911:20918 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.219901] binder: 20911:20918 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.220728] binder: 20911:20918 Release 1 refcount change on invalid ref 0 ret -22 [ 822.220743] binder: 20911:20918 transaction failed 29189/-22, size 0-0 line 3119 [ 822.232722] binder: 20915:20921 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.232736] binder: 20915:20921 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.294818] binder: 20929:20933 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.294832] binder: 20929:20933 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.304797] binder: 20930:20935 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.304811] binder: 20930:20935 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.305273] binder: 20930:20935 Release 1 refcount change on invalid ref 0 ret -22 [ 822.305288] binder: 20930:20935 transaction failed 29189/-22, size 0-0 line 3119 [ 822.347019] binder: 20944:20948 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.347033] binder: 20944:20948 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.348637] binder: 20942:20949 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.348649] binder: 20942:20949 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.348767] binder: 20942:20949 Release 1 refcount change on invalid ref 0 ret -22 [ 822.348780] binder: 20942:20949 transaction failed 29189/-22, size 0-0 line 3119 [ 822.402475] binder: 20960:20962 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.402489] binder: 20960:20962 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.402592] binder: 20960:20962 Release 1 refcount change on invalid ref 0 ret -22 [ 822.402605] binder: 20960:20962 transaction failed 29189/-22, size 0-0 line 3119 [ 822.418534] binder: 20959:20961 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.418548] binder: 20959:20961 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.476140] binder: 20971:20976 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.476154] binder: 20971:20976 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.476278] binder: 20971:20976 Release 1 refcount change on invalid ref 0 ret -22 [ 822.476292] binder: 20971:20976 transaction failed 29189/-22, size 0-0 line 3119 [ 822.489238] binder: 20973:20982 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.489251] binder: 20973:20982 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.543871] binder: 20988:20997 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.543884] binder: 20988:20997 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.544639] binder: 20988:20997 Release 1 refcount change on invalid ref 0 ret -22 [ 822.544653] binder: 20988:20997 transaction failed 29189/-22, size 0-0 line 3119 [ 822.574297] binder: 20991:21004 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.574310] binder: 20991:21004 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.626984] binder: 21006:21013 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.626997] binder: 21006:21013 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.627499] binder: 21006:21013 Release 1 refcount change on invalid ref 0 ret -22 [ 822.627514] binder: 21006:21013 transaction failed 29189/-22, size 0-0 line 3119 [ 822.658089] binder: 21017:21020 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.658102] binder: 21017:21020 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.698788] binder: 21026:21033 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.698802] binder: 21026:21033 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.698956] binder: 21026:21033 Release 1 refcount change on invalid ref 0 ret -22 [ 822.698973] binder: 21026:21033 transaction failed 29189/-22, size 0-0 line 3119 [ 822.730781] binder: 21035:21043 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.730794] binder: 21035:21043 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.762567] binder: 21046:21050 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.762580] binder: 21046:21050 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.771358] binder: 21046:21050 Release 1 refcount change on invalid ref 0 ret -22 [ 822.771372] binder: 21046:21050 transaction failed 29189/-22, size 0-0 line 3119 [ 822.803593] binder: 21056:21059 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.803606] binder: 21056:21059 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.838442] binder: 21063:21067 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.838455] binder: 21063:21067 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.838582] binder: 21063:21067 Release 1 refcount change on invalid ref 0 ret -22 [ 822.838594] binder: 21063:21067 transaction failed 29189/-22, size 0-0 line 3119 [ 822.864678] binder: 21070:21076 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.864691] binder: 21070:21076 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.918373] binder: 21080:21084 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.918385] binder: 21080:21084 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.922801] binder: 21080:21084 Release 1 refcount change on invalid ref 0 ret -22 [ 822.922816] binder: 21080:21084 transaction failed 29189/-22, size 0-0 line 3119 [ 822.934408] binder: 21087:21093 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.934422] binder: 21087:21093 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.985483] binder: 21095:21099 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.985496] binder: 21095:21099 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.986493] binder: 21095:21099 Release 1 refcount change on invalid ref 0 ret -22 [ 822.986508] binder: 21095:21099 transaction failed 29189/-22, size 0-0 line 3119 [ 822.995434] binder: 21098:21109 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.995446] binder: 21098:21109 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.048629] binder: 21116:21119 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.048642] binder: 21116:21119 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.048756] binder: 21116:21119 Release 1 refcount change on invalid ref 0 ret -22 [ 823.048770] binder: 21116:21119 transaction failed 29189/-22, size 0-0 line 3119 [ 823.052371] binder: 21117:21118 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.052382] binder: 21117:21118 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.115080] binder: 21129:21133 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.115101] binder: 21129:21133 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.119763] binder: 21130:21138 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.119775] binder: 21130:21138 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.129309] binder: 21129:21133 Release 1 refcount change on invalid ref 0 ret -22 [ 823.129325] binder: 21129:21133 transaction failed 29189/-22, size 0-0 line 3119 [ 823.189895] binder: 21150:21154 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.189907] binder: 21150:21154 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.190041] binder: 21150:21154 Release 1 refcount change on invalid ref 0 ret -22 [ 823.190053] binder: 21150:21154 transaction failed 29189/-22, size 0-0 line 3119 [ 823.198664] binder: 21146:21155 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.198678] binder: 21146:21155 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.265300] binder: 21163:21166 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.265313] binder: 21163:21166 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.265739] binder: 21163:21166 Release 1 refcount change on invalid ref 0 ret -22 [ 823.265751] binder: 21163:21166 transaction failed 29189/-22, size 0-0 line 3119 [ 823.267835] binder: 21167:21174 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.267847] binder: 21167:21174 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.337858] binder: 21187:21191 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.337871] binder: 21187:21191 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.339128] binder: 21188:21192 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.339140] binder: 21188:21192 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.339245] binder: 21188:21192 Release 1 refcount change on invalid ref 0 ret -22 [ 823.339258] binder: 21188:21192 transaction failed 29189/-22, size 0-0 line 3119 [ 823.400997] binder: 21196:21207 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.401010] binder: 21196:21207 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.401118] binder: 21196:21207 Release 1 refcount change on invalid ref 0 ret -22 [ 823.403293] binder: 21196:21207 transaction failed 29189/-22, size 0-0 line 3119 [ 823.417123] binder: 21203:21209 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.417136] binder: 21203:21209 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.465985] binder: 21219:21226 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.465998] binder: 21219:21226 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.482093] binder: 21218:21225 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.482107] binder: 21218:21225 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.482253] binder: 21218:21225 Release 1 refcount change on invalid ref 0 ret -22 [ 823.482267] binder: 21218:21225 transaction failed 29189/-22, size 0-0 line 3119 [ 823.635868] binder: 21241:21250 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.635890] binder: 21241:21250 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.638223] binder: 21248:21252 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.638235] binder: 21248:21252 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.638400] binder: 21248:21252 Release 1 refcount change on invalid ref 0 ret -22 [ 823.638413] binder: 21248:21252 transaction failed 29189/-22, size 0-0 line 3119 [ 823.704050] binder: 21259:21268 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.704063] binder: 21259:21268 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.711686] binder: 21262:21269 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.711699] binder: 21262:21269 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.711835] binder: 21262:21269 Release 1 refcount change on invalid ref 0 ret -22 [ 823.711848] binder: 21262:21269 transaction failed 29189/-22, size 0-0 line 3119 [ 823.762901] binder: 21272:21279 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.762919] binder: 21272:21279 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.771168] binder: 21274:21280 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.771181] binder: 21274:21280 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.773147] binder: 21274:21280 Release 1 refcount change on invalid ref 0 ret -22 [ 823.773161] binder: 21274:21280 transaction failed 29189/-22, size 0-0 line 3119 [ 823.815390] binder: 21287:21291 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.815405] binder: 21287:21291 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.815541] binder: 21287:21291 Release 1 refcount change on invalid ref 0 ret -22 [ 823.815553] binder: 21287:21291 transaction failed 29189/-22, size 0-0 line 3119 [ 823.837998] binder: 21292:21299 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.838011] binder: 21292:21299 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.879475] binder: 21302:21309 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.879487] binder: 21302:21309 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.879609] binder: 21302:21309 Release 1 refcount change on invalid ref 0 ret -22 [ 823.879621] binder: 21302:21309 transaction failed 29189/-22, size 0-0 line 3119 [ 823.899738] binder: 21306:21310 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.899752] binder: 21306:21310 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.943779] binder: 21318:21323 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.943793] binder: 21318:21323 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.943945] binder: 21318:21323 Release 1 refcount change on invalid ref 0 ret -22 [ 823.943961] binder: 21318:21323 transaction failed 29189/-22, size 0-0 line 3119 [ 823.956149] binder: 21321:21326 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.956164] binder: 21321:21326 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.006376] binder: 21334:21339 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.006388] binder: 21334:21339 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.007954] binder: 21334:21339 Release 1 refcount change on invalid ref 0 ret -22 [ 824.007968] binder: 21334:21339 transaction failed 29189/-22, size 0-0 line 3119 [ 824.015305] binder: 21335:21341 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.015318] binder: 21335:21341 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.080669] binder: 21348:21355 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.080682] binder: 21348:21355 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.092446] binder: 21351:21359 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.092460] binder: 21351:21359 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.092643] binder: 21351:21359 Release 1 refcount change on invalid ref 0 ret -22 [ 824.092656] binder: 21351:21359 transaction failed 29189/-22, size 0-0 line 3119 [ 824.157982] binder: 21365:21372 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.157995] binder: 21365:21372 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.165719] binder: 21370:21375 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.165731] binder: 21370:21375 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.166743] binder: 21370:21375 Release 1 refcount change on invalid ref 0 ret -22 [ 824.166757] binder: 21370:21375 transaction failed 29189/-22, size 0-0 line 3119 [ 824.232027] binder: 21387:21394 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.232039] binder: 21387:21394 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.267554] binder: 21390:21396 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.267568] binder: 21390:21396 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.268270] binder: 21390:21396 Release 1 refcount change on invalid ref 0 ret -22 [ 824.268283] binder: 21390:21396 transaction failed 29189/-22, size 0-0 line 3119 [ 824.299787] binder: 21401:21409 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.299802] binder: 21401:21409 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.337697] binder: 21413:21419 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.337711] binder: 21413:21419 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.337844] binder: 21413:21419 Release 1 refcount change on invalid ref 0 ret -22 [ 824.337861] binder: 21413:21419 transaction failed 29189/-22, size 0-0 line 3119 [ 824.373663] binder: 21425:21429 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.373676] binder: 21425:21429 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.373789] binder: 21425:21429 Release 1 refcount change on invalid ref 0 ret -22 [ 824.373802] binder: 21425:21429 transaction failed 29189/-22, size 0-0 line 3119 [ 824.375522] binder: 21420:21428 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.375534] binder: 21420:21428 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.432507] binder: 21433:21437 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.432522] binder: 21433:21437 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.441785] binder: 21440:21444 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.441799] binder: 21440:21444 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.441917] binder: 21440:21444 Release 1 refcount change on invalid ref 0 ret -22 [ 824.441930] binder: 21440:21444 transaction failed 29189/-22, size 0-0 line 3119 [ 824.501214] binder: 21454:21458 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.501229] binder: 21454:21458 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.501559] binder: 21454:21458 Release 1 refcount change on invalid ref 0 ret -22 [ 824.501572] binder: 21454:21458 transaction failed 29189/-22, size 0-0 line 3119 [ 824.507532] binder: 21453:21462 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.507545] binder: 21453:21462 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.561493] binder: 21465:21474 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.561507] binder: 21465:21474 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.561616] binder: 21465:21474 Release 1 refcount change on invalid ref 0 ret -22 [ 824.561628] binder: 21465:21474 transaction failed 29189/-22, size 0-0 line 3119 [ 824.595836] binder: 21471:21478 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.595848] binder: 21471:21478 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.631129] binder: 21488:21494 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.631142] binder: 21488:21494 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.635313] binder: 21488:21494 Release 1 refcount change on invalid ref 0 ret -22 [ 824.635329] binder: 21488:21494 transaction failed 29189/-22, size 0-0 line 3119 [ 824.671840] binder: 21493:21495 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.671853] binder: 21493:21495 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.698723] binder: 21507:21509 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.698741] binder: 21507:21509 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.699039] binder: 21507:21509 Release 1 refcount change on invalid ref 0 ret -22 [ 824.699057] binder: 21507:21509 transaction failed 29189/-22, size 0-0 line 3119 [ 824.732226] binder: 21511:21515 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.732239] binder: 21511:21515 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.770009] binder: 21521:21525 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.770023] binder: 21521:21525 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.770161] binder: 21521:21525 Release 1 refcount change on invalid ref 0 ret -22 [ 824.770174] binder: 21521:21525 transaction failed 29189/-22, size 0-0 line 3119 [ 824.809386] binder: 21526:21530 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.809401] binder: 21526:21530 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.820905] binder: 21536:21540 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.820931] binder: 21536:21540 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.835163] binder: 21536:21540 Release 1 refcount change on invalid ref 0 ret -22 [ 824.835179] binder: 21536:21540 transaction failed 29189/-22, size 0-0 line 3119 [ 824.883578] binder: 21543:21550 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.883591] binder: 21543:21550 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.897122] binder: 21547:21552 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.897134] binder: 21547:21552 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.897245] binder: 21547:21552 Release 1 refcount change on invalid ref 0 ret -22 [ 824.897257] binder: 21547:21552 transaction failed 29189/-22, size 0-0 line 3119 [ 824.925770] binder: 21560:21565 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.925783] binder: 21560:21565 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.965333] binder: 21564:21569 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.965347] binder: 21564:21569 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.966388] binder: 21564:21569 Release 1 refcount change on invalid ref 0 ret -22 [ 824.966402] binder: 21564:21569 transaction failed 29189/-22, size 0-0 line 3119 [ 825.008513] binder: 21581:21583 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.008527] binder: 21581:21583 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.009074] binder: 21581:21583 Release 1 refcount change on invalid ref 0 ret -22 [ 825.009087] binder: 21581:21583 transaction failed 29189/-22, size 0-0 line 3119 [ 825.026653] binder: 21580:21587 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.026667] binder: 21580:21587 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.045682] binder: 21591:21592 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.045695] binder: 21591:21592 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.045801] binder: 21591:21592 Release 1 refcount change on invalid ref 0 ret -22 [ 825.045815] binder: 21591:21592 transaction failed 29189/-22, size 0-0 line 3119 [ 825.106372] binder: 21602:21605 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.106410] binder: 21602:21605 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.106604] binder: 21602:21605 Release 1 refcount change on invalid ref 0 ret -22 [ 825.106619] binder: 21602:21605 transaction failed 29189/-22, size 0-0 line 3119 [ 825.133013] binder: 21603:21609 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.133027] binder: 21603:21609 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.184441] binder: 21614:21620 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.184456] binder: 21614:21620 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.184600] binder: 21614:21620 Release 1 refcount change on invalid ref 0 ret -22 [ 825.184613] binder: 21614:21620 transaction failed 29189/-22, size 0-0 line 3119 [ 825.215933] binder: 21618:21628 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.215947] binder: 21618:21628 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.245547] binder: 21629:21636 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.245560] binder: 21629:21636 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.248745] binder: 21629:21636 Release 1 refcount change on invalid ref 0 ret -22 [ 825.248759] binder: 21629:21636 transaction failed 29189/-22, size 0-0 line 3119 [ 825.284671] binder: 21638:21645 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.284684] binder: 21638:21645 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.335810] binder: 21641:21653 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.335823] binder: 21641:21653 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.335948] binder: 21641:21653 Release 1 refcount change on invalid ref 0 ret -22 [ 825.335962] binder: 21641:21653 transaction failed 29189/-22, size 0-0 line 3119 [ 825.359090] binder: 21652:21658 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.359103] binder: 21652:21658 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.403575] binder: 21664:21671 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.403589] binder: 21664:21671 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.404189] binder: 21664:21671 Release 1 refcount change on invalid ref 0 ret -22 [ 825.404202] binder: 21664:21671 transaction failed 29189/-22, size 0-0 line 3119 [ 825.420940] binder: 21669:21677 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.420954] binder: 21669:21677 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.470999] binder: 21683:21686 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.471014] binder: 21683:21686 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.471177] binder: 21683:21686 Release 1 refcount change on invalid ref 0 ret -22 [ 825.471190] binder: 21683:21686 transaction failed 29189/-22, size 0-0 line 3119 [ 825.505265] binder: 21687:21693 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.505317] binder: 21687:21693 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.529074] binder: 21695:21702 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.529087] binder: 21695:21702 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.529216] binder: 21695:21702 Release 1 refcount change on invalid ref 0 ret -22 [ 825.529229] binder: 21695:21702 transaction failed 29189/-22, size 0-0 line 3119 [ 825.581320] binder: 21706:21715 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.581333] binder: 21706:21715 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.609772] binder: 21712:21717 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.609785] binder: 21712:21717 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.609912] binder: 21712:21717 Release 1 refcount change on invalid ref 0 ret -22 [ 825.609925] binder: 21712:21717 transaction failed 29189/-22, size 0-0 line 3119 [ 825.649391] binder: 21722:21731 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.649406] binder: 21722:21731 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.656275] binder: 21730:21735 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.656340] binder: 21730:21735 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.657061] binder: 21730:21735 Release 1 refcount change on invalid ref 0 ret -22 [ 825.657075] binder: 21730:21735 transaction failed 29189/-22, size 0-0 line 3119 [ 825.711365] binder: 21742:21747 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.711405] binder: 21742:21747 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.713156] binder: 21742:21747 Release 1 refcount change on invalid ref 0 ret -22 [ 825.713169] binder: 21742:21747 transaction failed 29189/-22, size 0-0 line 3119 [ 825.726273] binder: 21746:21750 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.726286] binder: 21746:21750 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.796764] binder: 21755:21763 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.796777] binder: 21755:21763 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.810758] binder: 21759:21769 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.810771] binder: 21759:21769 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.810898] binder: 21759:21769 Release 1 refcount change on invalid ref 0 ret -22 [ 825.810912] binder: 21759:21769 transaction failed 29189/-22, size 0-0 line 3119 [ 825.849046] binder: 21777:21780 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.849059] binder: 21777:21780 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.882823] binder: 21781:21786 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.882837] binder: 21781:21786 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.883967] binder: 21781:21786 Release 1 refcount change on invalid ref 0 ret -22 [ 825.883982] binder: 21781:21786 transaction failed 29189/-22, size 0-0 line 3119 [ 825.898261] binder: 21789:21793 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.898273] binder: 21789:21793 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.977607] binder: 21799:21807 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.977666] binder: 21799:21807 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.977896] binder: 21799:21807 Release 1 refcount change on invalid ref 0 ret -22 [ 825.977909] binder: 21799:21807 transaction failed 29189/-22, size 0-0 line 3119 [ 825.990727] binder: 21804:21811 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.990740] binder: 21804:21811 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.040742] binder: 21817:21824 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.040757] binder: 21817:21824 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.040948] binder: 21817:21824 Release 1 refcount change on invalid ref 0 ret -22 [ 826.040962] binder: 21817:21824 transaction failed 29189/-22, size 0-0 line 3119 [ 826.089176] binder: 21825:21836 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.089189] binder: 21825:21836 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.131130] binder: 21835:21841 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.131172] binder: 21835:21841 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.131307] binder: 21835:21841 Release 1 refcount change on invalid ref 0 ret -22 [ 826.131320] binder: 21835:21841 transaction failed 29189/-22, size 0-0 line 3119 [ 826.136673] binder: 21844:21850 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.136685] binder: 21844:21850 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.192759] binder: 21854:21858 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.192773] binder: 21854:21858 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.192904] binder: 21854:21858 Release 1 refcount change on invalid ref 0 ret -22 [ 826.192918] binder: 21854:21858 transaction failed 29189/-22, size 0-0 line 3119 [ 826.193949] binder: 21856:21862 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.193961] binder: 21856:21862 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.253110] binder: 21870:21875 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.253124] binder: 21870:21875 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.260068] binder: 21871:21877 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.260084] binder: 21871:21877 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.260208] binder: 21871:21877 Release 1 refcount change on invalid ref 0 ret -22 [ 826.260223] binder: 21871:21877 transaction failed 29189/-22, size 0-0 line 3119 [ 826.315914] binder: 21882:21884 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.315927] binder: 21882:21884 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.326747] binder: 21885:21894 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.326760] binder: 21885:21894 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.326938] binder: 21885:21894 Release 1 refcount change on invalid ref 0 ret -22 [ 826.326952] binder: 21885:21894 transaction failed 29189/-22, size 0-0 line 3119 [ 826.366097] binder: 21899:21902 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.366111] binder: 21899:21902 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.410429] binder: 21903:21912 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.410443] binder: 21903:21912 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.412990] binder: 21903:21912 Release 1 refcount change on invalid ref 0 ret -22 [ 826.413004] binder: 21903:21912 transaction failed 29189/-22, size 0-0 line 3119 [ 826.463930] binder: 21916:21926 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.463944] binder: 21916:21926 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.464616] binder: 21921:21927 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.464628] binder: 21921:21927 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.464747] binder: 21921:21927 Release 1 refcount change on invalid ref 0 ret -22 [ 826.464760] binder: 21921:21927 transaction failed 29189/-22, size 0-0 line 3119 [ 826.527442] binder: 21937:21941 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.527456] binder: 21937:21941 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.532817] binder: 21934:21942 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.532829] binder: 21934:21942 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.533229] binder: 21934:21942 Release 1 refcount change on invalid ref 0 ret -22 [ 826.533243] binder: 21934:21942 transaction failed 29189/-22, size 0-0 line 3119 [ 826.589560] binder: 21951:21955 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.589574] binder: 21951:21955 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.600690] binder: 21954:21957 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.600704] binder: 21954:21957 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.600816] binder: 21954:21957 Release 1 refcount change on invalid ref 0 ret -22 [ 826.600830] binder: 21954:21957 transaction failed 29189/-22, size 0-0 line 3119 [ 826.660986] binder: 21969:21977 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.661000] binder: 21969:21977 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.661992] binder: 21969:21977 Release 1 refcount change on invalid ref 0 ret -22 [ 826.662005] binder: 21969:21977 transaction failed 29189/-22, size 0-0 line 3119 [ 826.665045] binder: 21967:21970 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.665059] binder: 21967:21970 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.722484] binder: 21983:21989 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.722497] binder: 21983:21989 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.722608] binder: 21983:21989 Release 1 refcount change on invalid ref 0 ret -22 [ 826.722619] binder: 21983:21989 transaction failed 29189/-22, size 0-0 line 3119 [ 826.755709] binder: 21988:21996 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.755722] binder: 21988:21996 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.774661] binder: 21998:22003 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.774675] binder: 21998:22003 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.775392] binder: 21998:22003 Release 1 refcount change on invalid ref 0 ret -22 [ 826.775405] binder: 21998:22003 transaction failed 29189/-22, size 0-0 line 3119 [ 826.832929] binder: 22010:22013 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.832942] binder: 22010:22013 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.840322] binder: 22014:22020 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.840384] binder: 22014:22020 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.841478] binder: 22014:22020 Release 1 refcount change on invalid ref 0 ret -22 [ 826.841492] binder: 22014:22020 transaction failed 29189/-22, size 0-0 line 3119 [ 826.875964] binder: 22024:22030 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.875976] binder: 22024:22030 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.899488] binder: 22028:22033 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.899500] binder: 22028:22033 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.899625] binder: 22028:22033 Release 1 refcount change on invalid ref 0 ret -22 [ 826.899638] binder: 22028:22033 transaction failed 29189/-22, size 0-0 line 3119 [ 826.965289] binder: 22040:22048 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.965304] binder: 22040:22048 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.965443] binder: 22040:22048 Release 1 refcount change on invalid ref 0 ret -22 [ 826.965457] binder: 22040:22048 transaction failed 29189/-22, size 0-0 line 3119 [ 826.976395] binder: 22045:22051 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.976409] binder: 22045:22051 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.053789] binder: 22058:22062 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.053802] binder: 22058:22062 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.053920] binder: 22058:22062 Release 1 refcount change on invalid ref 0 ret -22 [ 827.053933] binder: 22058:22062 transaction failed 29189/-22, size 0-0 line 3119 [ 827.077168] binder: 22063:22071 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.077185] binder: 22063:22071 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.136734] binder: 22081:22085 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.136749] binder: 22081:22085 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.136927] binder: 22081:22085 Release 1 refcount change on invalid ref 0 ret -22 [ 827.136940] binder: 22081:22085 transaction failed 29189/-22, size 0-0 line 3119 [ 827.139305] binder: 22080:22088 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.139318] binder: 22080:22088 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.190438] binder: 22096:22102 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.190452] binder: 22096:22102 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.191350] binder: 22096:22102 Release 1 refcount change on invalid ref 0 ret -22 [ 827.191364] binder: 22096:22102 transaction failed 29189/-22, size 0-0 line 3119 [ 827.193703] binder: 22099:22104 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.193715] binder: 22099:22104 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.246276] binder: 22113:22116 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.246289] binder: 22113:22116 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.300547] binder: 22112:22127 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.300560] binder: 22112:22127 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.300673] binder: 22112:22127 Release 1 refcount change on invalid ref 0 ret -22 [ 827.300685] binder: 22112:22127 transaction failed 29189/-22, size 0-0 line 3119 [ 827.326025] binder: 22128:22132 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.326039] binder: 22128:22132 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.362364] binder: 22137:22140 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.362387] binder: 22137:22140 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.362779] binder: 22137:22140 Release 1 refcount change on invalid ref 0 ret -22 [ 827.362798] binder: 22137:22140 transaction failed 29189/-22, size 0-0 line 3119 [ 827.410122] binder: 22144:22151 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.410135] binder: 22144:22151 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.450220] binder: 22156:22159 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.450233] binder: 22156:22159 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.450595] binder: 22156:22159 Release 1 refcount change on invalid ref 0 ret -22 [ 827.450610] binder: 22156:22159 transaction failed 29189/-22, size 0-0 line 3119 [ 827.475641] binder: 22167:22171 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.475654] binder: 22167:22171 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.523998] binder: 22178:22183 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.524012] binder: 22178:22183 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.524594] binder: 22179:22182 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.524649] binder: 22179:22182 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.524779] binder: 22178:22183 Release 1 refcount change on invalid ref 0 ret -22 [ 827.524793] binder: 22178:22183 transaction failed 29189/-22, size 0-0 line 3119 [ 827.602156] binder: 22193:22199 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.602171] binder: 22193:22199 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.603864] binder: 22198:22203 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.603884] binder: 22198:22203 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.604008] binder: 22198:22203 Release 1 refcount change on invalid ref 0 ret -22 [ 827.604022] binder: 22198:22203 transaction failed 29189/-22, size 0-0 line 3119 [ 827.661696] binder: 22211:22218 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.661710] binder: 22211:22218 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.661833] binder: 22211:22218 Release 1 refcount change on invalid ref 0 ret -22 [ 827.661846] binder: 22211:22218 transaction failed 29189/-22, size 0-0 line 3119 [ 827.664752] binder: 22212:22217 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.664764] binder: 22212:22217 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.721561] binder: 22225:22233 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.721578] binder: 22225:22233 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.722308] binder: 22225:22233 Release 1 refcount change on invalid ref 0 ret -22 [ 827.722322] binder: 22225:22233 transaction failed 29189/-22, size 0-0 line 3119 [ 827.735899] binder: 22229:22235 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.735911] binder: 22229:22235 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.789610] binder: 22241:22243 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.789625] binder: 22241:22243 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.790236] binder: 22241:22243 Release 1 refcount change on invalid ref 0 ret -22 [ 827.790250] binder: 22241:22243 transaction failed 29189/-22, size 0-0 line 3119 [ 827.803282] binder: 22246:22253 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.803294] binder: 22246:22253 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.850997] binder: 22256:22265 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.851011] binder: 22256:22265 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.851140] binder: 22256:22265 Release 1 refcount change on invalid ref 0 ret -22 [ 827.851153] binder: 22256:22265 transaction failed 29189/-22, size 0-0 line 3119 [ 827.853507] binder: 22260:22266 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.853529] binder: 22260:22266 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.917650] binder: 22272:22283 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.917663] binder: 22272:22283 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.919004] binder: 22275:22282 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.919017] binder: 22275:22282 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.919068] binder: 22272:22283 Release 1 refcount change on invalid ref 0 ret -22 [ 827.919081] binder: 22272:22283 transaction failed 29189/-22, size 0-0 line 3119 [ 827.992120] binder: 22294:22298 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.992133] binder: 22294:22298 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.992249] binder: 22294:22298 Release 1 refcount change on invalid ref 0 ret -22 [ 827.992261] binder: 22294:22298 transaction failed 29189/-22, size 0-0 line 3119 [ 828.013741] binder: 22293:22302 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.013812] binder: 22293:22302 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.067438] binder: 22306:22316 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.067452] binder: 22306:22316 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.067582] binder: 22306:22316 Release 1 refcount change on invalid ref 0 ret -22 [ 828.067594] binder: 22306:22316 transaction failed 29189/-22, size 0-0 line 3119 [ 828.069858] binder: 22313:22317 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.069879] binder: 22313:22317 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.146807] binder: 22326:22337 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.146820] binder: 22326:22337 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.147099] binder: 22326:22337 Release 1 refcount change on invalid ref 0 ret -22 [ 828.147112] binder: 22326:22337 transaction failed 29189/-22, size 0-0 line 3119 [ 828.150245] binder: 22329:22339 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.150257] binder: 22329:22339 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.232412] binder: 22347:22356 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.232426] binder: 22347:22356 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.232682] binder: 22346:22358 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.232694] binder: 22346:22358 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.232819] binder: 22346:22358 Release 1 refcount change on invalid ref 0 ret -22 [ 828.232832] binder: 22346:22358 transaction failed 29189/-22, size 0-0 line 3119 [ 828.298213] binder: 22366:22372 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.298226] binder: 22366:22372 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.322124] binder: 22375:22380 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.322138] binder: 22375:22380 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.322284] binder: 22375:22380 Release 1 refcount change on invalid ref 0 ret -22 [ 828.322296] binder: 22375:22380 transaction failed 29189/-22, size 0-0 line 3119 [ 828.382055] binder: 22382:22391 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.382067] binder: 22382:22391 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.388136] binder: 22389:22395 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.388156] binder: 22389:22395 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.399997] binder: 22389:22395 Release 1 refcount change on invalid ref 0 ret -22 [ 828.400014] binder: 22389:22395 transaction failed 29189/-22, size 0-0 line 3119 [ 828.442229] binder: 22400:22404 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.442242] binder: 22400:22404 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.461582] binder: 22409:22412 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.461594] binder: 22409:22412 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.462444] binder: 22409:22412 Release 1 refcount change on invalid ref 0 ret -22 [ 828.462457] binder: 22409:22412 transaction failed 29189/-22, size 0-0 line 3119 [ 828.521396] binder: 22418:22424 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.521411] binder: 22418:22424 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.521670] binder: 22418:22424 Release 1 refcount change on invalid ref 0 ret -22 [ 828.521684] binder: 22418:22424 transaction failed 29189/-22, size 0-0 line 3119 [ 828.534011] binder: 22419:22427 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.534024] binder: 22419:22427 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.603745] binder: 22442:22446 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.603761] binder: 22442:22446 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.603791] binder: 22433:22445 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.603801] binder: 22433:22445 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.604181] binder: 22433:22445 Release 1 refcount change on invalid ref 0 ret -22 [ 828.604194] binder: 22433:22445 transaction failed 29189/-22, size 0-0 line 3119 [ 828.681101] binder: 22451:22462 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.681114] binder: 22451:22462 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.689336] binder: 22459:22466 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.689349] binder: 22459:22466 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.690099] binder: 22459:22466 Release 1 refcount change on invalid ref 0 ret -22 [ 828.690112] binder: 22459:22466 transaction failed 29189/-22, size 0-0 line 3119 [ 828.758361] binder: 22472:22482 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.758436] binder: 22472:22482 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.759817] binder: 22475:22481 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.759830] binder: 22475:22481 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.759965] binder: 22475:22481 Release 1 refcount change on invalid ref 0 ret -22 [ 828.759979] binder: 22475:22481 transaction failed 29189/-22, size 0-0 line 3119 [ 828.796233] binder: 22486:22491 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.796246] binder: 22486:22491 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.796374] binder: 22486:22491 Release 1 refcount change on invalid ref 0 ret -22 [ 828.796387] binder: 22486:22491 transaction failed 29189/-22, size 0-0 line 3119 [ 828.800453] binder: 22485:22492 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.800466] binder: 22485:22492 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.854236] binder: 22497:22501 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.854250] binder: 22497:22501 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.854413] binder: 22497:22501 Release 1 refcount change on invalid ref 0 ret -22 [ 828.854427] binder: 22497:22501 transaction failed 29189/-22, size 0-0 line 3119 [ 828.879204] binder: 22499:22504 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.879217] binder: 22499:22504 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.912050] binder: 22512:22521 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.912063] binder: 22512:22521 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.912294] binder: 22512:22521 Release 1 refcount change on invalid ref 0 ret -22 [ 828.912306] binder: 22512:22521 transaction failed 29189/-22, size 0-0 line 3119 [ 828.936345] binder: 22516:22522 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.936413] binder: 22516:22522 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.981869] binder: 22529:22536 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.981891] binder: 22529:22536 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.982016] binder: 22529:22536 Release 1 refcount change on invalid ref 0 ret -22 [ 828.982030] binder: 22529:22536 transaction failed 29189/-22, size 0-0 line 3119 [ 828.992250] binder: 22532:22537 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.992263] binder: 22532:22537 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.058620] binder: 22542:22550 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.058634] binder: 22542:22550 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.058754] binder: 22542:22550 Release 1 refcount change on invalid ref 0 ret -22 [ 829.058767] binder: 22542:22550 transaction failed 29189/-22, size 0-0 line 3119 [ 829.092905] binder: 22549:22557 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.092918] binder: 22549:22557 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.110458] binder: 22566:22567 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.110472] binder: 22566:22567 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.110599] binder: 22566:22567 Release 1 refcount change on invalid ref 0 ret -22 [ 829.110613] binder: 22566:22567 transaction failed 29189/-22, size 0-0 line 3119 [ 829.178775] binder: 22573:22583 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.178788] binder: 22573:22583 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.192546] binder: 22574:22584 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.192559] binder: 22574:22584 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.192684] binder: 22574:22584 Release 1 refcount change on invalid ref 0 ret -22 [ 829.192698] binder: 22574:22584 transaction failed 29189/-22, size 0-0 line 3119 [ 829.211191] binder: 22587:22589 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.211205] binder: 22587:22589 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.268051] binder: 22598:22601 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.268064] binder: 22598:22601 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.275693] binder: 22600:22606 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.275706] binder: 22600:22606 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.276816] binder: 22600:22606 Release 1 refcount change on invalid ref 0 ret -22 [ 829.276830] binder: 22600:22606 transaction failed 29189/-22, size 0-0 line 3119 [ 829.332802] binder: 22612:22621 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.332816] binder: 22612:22621 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.357783] binder: 22617:22622 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.357796] binder: 22617:22622 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.357915] binder: 22617:22622 Release 1 refcount change on invalid ref 0 ret -22 [ 829.357928] binder: 22617:22622 transaction failed 29189/-22, size 0-0 line 3119 [ 829.384198] binder: 22628:22632 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.384212] binder: 22628:22632 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.424695] binder: 22635:22643 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.424710] binder: 22635:22643 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.424888] binder: 22635:22643 Release 1 refcount change on invalid ref 0 ret -22 [ 829.424901] binder: 22635:22643 transaction failed 29189/-22, size 0-0 line 3119 [ 829.440474] binder: 22640:22647 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.440487] binder: 22640:22647 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.496166] binder: 22653:22660 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.496180] binder: 22653:22660 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.498067] binder: 22651:22659 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.498079] binder: 22651:22659 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.498324] binder: 22651:22659 Release 1 refcount change on invalid ref 0 ret -22 [ 829.498337] binder: 22651:22659 transaction failed 29189/-22, size 0-0 line 3119 [ 829.551568] binder: 22672:22674 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.551585] binder: 22672:22674 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.552531] binder: 22672:22674 Release 1 refcount change on invalid ref 0 ret -22 [ 829.552548] binder: 22672:22674 transaction failed 29189/-22, size 0-0 line 3119 [ 829.559655] binder: 22668:22673 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.559669] binder: 22668:22673 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.612932] binder: 22680:22685 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.612945] binder: 22680:22685 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.634641] binder: 22686:22693 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.634654] binder: 22686:22693 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.634781] binder: 22686:22693 Release 1 refcount change on invalid ref 0 ret -22 [ 829.634795] binder: 22686:22693 transaction failed 29189/-22, size 0-0 line 3119 [ 829.686427] binder: 22696:22698 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.686440] binder: 22696:22698 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.716485] binder: 22708:22714 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.716499] binder: 22708:22714 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.716627] binder: 22708:22714 Release 1 refcount change on invalid ref 0 ret -22 [ 829.716641] binder: 22708:22714 transaction failed 29189/-22, size 0-0 line 3119 [ 829.744463] binder: 22716:22718 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.744476] binder: 22716:22718 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.774493] binder: 22723:22726 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.774510] binder: 22723:22726 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.774692] binder: 22723:22726 Release 1 refcount change on invalid ref 0 ret -22 [ 829.774708] binder: 22723:22726 transaction failed 29189/-22, size 0-0 line 3119 [ 829.804793] binder: 22730:22731 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.804810] binder: 22730:22731 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.845233] binder: 22736:22741 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 829.845247] binder: 22736:22741 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.845889] binder: 22736:22741 Release 1 refcount change on invalid ref 0 ret -22 [ 829.845903] binder: 22736:22741 transaction failed 29189/-22, size 0-0 line 3119 [ 841.473868] binder: undelivered TRANSACTION_ERROR: 29189 [ 841.479469] binder: undelivered TRANSACTION_ERROR: 29189 [ 841.485056] binder: undelivered TRANSACTION_ERROR: 29189 [ 841.490677] binder: undelivered TRANSACTION_ERROR: 29189 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.502384] binder: undelivered TRANSACTION_ERROR: 29189 [ 841.517808] binder: 22749:22755 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 841.517822] binder: 22749:22755 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 841.518263] binder: 22749:22755 Release 1 refcount change on invalid ref 0 ret -22 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 841.518278] binder: 22749:22755 transaction failed 29189/-22, size 0-0 line 3119 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 841.518612] binder: 22747:22756 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 841.518625] binder: 22747:22756 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 841.556315] binder: 22760:22766 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 841.556329] binder: 22760:22766 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.556474] binder: 22760:22766 Release 1 refcount change on invalid ref 0 ret -22 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 841.556487] binder: 22760:22766 transaction failed 29189/-22, size 0-0 line 3119 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 841.583174] binder: 22765:22771 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 841.583186] binder: 22765:22771 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.638943] binder: 22782:22786 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.638955] binder: 22782:22786 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.642537] binder: 22777:22781 Acquire 1 refcount change on invalid ref 0 ret -22 [ 841.642548] binder: 22777:22781 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 841.642669] binder: 22777:22781 Release 1 refcount change on invalid ref 0 ret -22 [ 841.642687] binder: 22777:22781 transaction failed 29189/-22, size 0-0 line 3119 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.693696] binder: 22793:22798 Acquire 1 refcount change on invalid ref 0 ret -22 [ 841.693709] binder: 22793:22798 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 841.693831] binder: 22793:22798 Release 1 refcount change on invalid ref 0 ret -22 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 841.693844] binder: 22793:22798 transaction failed 29189/-22, size 0-0 line 3119 [ 841.727473] binder: 22797:22804 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 841.727488] binder: 22797:22804 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 841.757863] binder: 22811:22816 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.757876] binder: 22811:22816 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 841.758548] binder: 22811:22816 Release 1 refcount change on invalid ref 0 ret -22 [ 841.758560] binder: 22811:22816 transaction failed 29189/-22, size 0-0 line 3119 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.786467] binder: 22819:22822 Acquire 1 refcount change on invalid ref 0 ret -22 [ 841.786480] binder: 22819:22822 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 841.823722] binder: 22827:22831 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.823735] binder: 22827:22831 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 841.823868] binder: 22827:22831 Release 1 refcount change on invalid ref 0 ret -22 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 841.823889] binder: 22827:22831 transaction failed 29189/-22, size 0-0 line 3119 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 841.861677] binder: 22836:22842 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.861689] binder: 22836:22842 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 841.893569] binder: 22846:22851 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.893582] binder: 22846:22851 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 841.897371] binder: 22846:22851 Release 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.897397] binder: 22846:22851 transaction failed 29189/-22, size 0-0 line 3119 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 841.936118] binder: 22857:22861 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.936133] binder: 22857:22861 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 841.956569] binder: 22862:22867 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 841.956582] binder: 22862:22867 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 841.956710] binder: 22862:22867 Release 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.956723] binder: 22862:22867 transaction failed 29189/-22, size 0-0 line 3119 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.984202] binder: 22872:22876 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.984215] binder: 22872:22876 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 841.984340] binder: 22872:22876 Release 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 841.984353] binder: 22872:22876 transaction failed 29189/-22, size 0-0 line 3119 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.991666] binder: 22873:22878 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.991678] binder: 22873:22878 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.044332] binder: 22886:22889 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.044344] binder: 22886:22889 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.056642] binder: 22892:22896 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.056654] binder: 22892:22896 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.056773] binder: 22892:22896 Release 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.056786] binder: 22892:22896 transaction failed 29189/-22, size 0-0 line 3119 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 842.092799] binder: 22900:22902 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.092812] binder: 22900:22902 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.133620] binder: 22912:22918 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.133633] binder: 22912:22918 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.139605] binder: 22909:22919 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.139617] binder: 22909:22919 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.139730] binder: 22909:22919 Release 1 refcount change on invalid ref 0 ret -22 [ 842.139745] binder: 22909:22919 transaction failed 29189/-22, size 0-0 line 3119 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.191781] binder: 22924:22927 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.191795] binder: 22924:22927 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.228126] binder: 22930:22935 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.228141] binder: 22930:22935 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.228521] binder: 22930:22935 Release 1 refcount change on invalid ref 0 ret -22 [ 842.228534] binder: 22930:22935 transaction failed 29189/-22, size 0-0 line 3119 [ 842.250521] binder: 22940:22945 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.250534] binder: 22940:22945 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.287977] binder: 22947:22951 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.287991] binder: 22947:22951 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.288199] binder: 22947:22951 Release 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.288212] binder: 22947:22951 transaction failed 29189/-22, size 0-0 line 3119 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.322038] binder: 22959:22963 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.322051] binder: 22959:22963 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.371660] binder: 22969:22971 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.371673] binder: 22969:22971 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.375194] binder: 22966:22972 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.375206] binder: 22966:22972 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.375316] binder: 22966:22972 Release 1 refcount change on invalid ref 0 ret -22 [ 842.375329] binder: 22966:22972 transaction failed 29189/-22, size 0-0 line 3119 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.412456] binder: 22986:22988 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.412467] binder: 22986:22988 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.412567] binder: 22986:22988 Release 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.412578] binder: 22986:22988 transaction failed 29189/-22, size 0-0 line 3119 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 842.430777] binder: 22983:22995 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 842.430791] binder: 22983:22995 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.476269] binder: 22994:23001 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.476283] binder: 22994:23001 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.476394] binder: 22994:23001 Release 1 refcount change on invalid ref 0 ret -22 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.476407] binder: 22994:23001 transaction failed 29189/-22, size 0-0 line 3119 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.494623] binder: 23000:23009 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.494639] binder: 23000:23009 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.528746] binder: 23012:23013 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.528759] binder: 23012:23013 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.528870] binder: 23012:23013 Release 1 refcount change on invalid ref 0 ret -22 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.528882] binder: 23012:23013 transaction failed 29189/-22, size 0-0 line 3119 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 842.549729] binder: 23017:23022 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 842.549742] binder: 23017:23022 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.593610] binder: 23026:23032 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.593622] binder: 23026:23032 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.593734] binder: 23026:23032 Release 1 refcount change on invalid ref 0 ret -22 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.593750] binder: 23026:23032 transaction failed 29189/-22, size 0-0 line 3119 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.597489] binder: 23034:23039 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.597502] binder: 23034:23039 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.654633] binder: 23048:23049 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 842.654646] binder: 23048:23049 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.698063] binder: 23056:23059 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.698076] binder: 23056:23059 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.698835] binder: 23056:23059 Release 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.698848] binder: 23056:23059 transaction failed 29189/-22, size 0-0 line 3119 [ 842.730312] binder: 23062:23065 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.730325] binder: 23062:23065 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 842.747732] binder: 23070:23076 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.747745] binder: 23070:23076 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.747866] binder: 23070:23076 Release 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.747886] binder: 23070:23076 transaction failed 29189/-22, size 0-0 line 3119 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 842.791423] binder: 23077:23079 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.791435] binder: 23077:23079 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 842.822299] binder: 23084:23092 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.822312] binder: 23084:23092 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.822447] binder: 23084:23092 Release 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.822460] binder: 23084:23092 transaction failed 29189/-22, size 0-0 line 3119 [ 842.854776] binder: 23095:23099 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.854790] binder: 23095:23099 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.880643] binder: 23106:23110 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.880657] binder: 23106:23110 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.880786] binder: 23106:23110 Release 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.880799] binder: 23106:23110 transaction failed 29189/-22, size 0-0 line 3119 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 842.888522] binder: 23108:23112 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.888534] binder: 23108:23112 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.945033] binder: 23119:23121 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.945047] binder: 23119:23121 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.945343] binder: 23119:23121 Release 1 refcount change on invalid ref 0 ret -22 [ 842.945356] binder: 23119:23121 transaction failed 29189/-22, size 0-0 line 3119 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 842.965348] binder: 23124:23130 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.965360] binder: 23124:23130 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.993471] binder: 23134:23140 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.993484] binder: 23134:23140 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.005970] binder: 23134:23140 Release 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 843.005984] binder: 23134:23140 transaction failed 29189/-22, size 0-0 line 3119 [ 843.018184] binder: 23139:23147 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.018197] binder: 23139:23147 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.067745] binder: 23156:23162 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.067759] binder: 23156:23162 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.067896] binder: 23156:23162 Release 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.067908] binder: 23156:23162 transaction failed 29189/-22, size 0-0 line 3119 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.074599] binder: 23159:23163 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.074611] binder: 23159:23163 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.140948] binder: 23166:23176 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 843.140961] binder: 23166:23176 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.146651] binder: 23172:23180 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.146664] binder: 23172:23180 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.146789] binder: 23172:23180 Release 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.146802] binder: 23172:23180 transaction failed 29189/-22, size 0-0 line 3119 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.198584] binder: 23188:23195 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.198598] binder: 23188:23195 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.221305] binder: 23192:23198 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.221319] binder: 23192:23198 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.221435] binder: 23192:23198 Release 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.221448] binder: 23192:23198 transaction failed 29189/-22, size 0-0 line 3119 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.244920] binder: 23201:23207 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.244933] binder: 23201:23207 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.259332] binder: 23206:23211 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.259344] binder: 23206:23211 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.259473] binder: 23206:23211 Release 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.259486] binder: 23206:23211 transaction failed 29189/-22, size 0-0 line 3119 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.302427] binder: 23220:23224 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.302443] binder: 23220:23224 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.303281] binder: 23217:23222 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 843.303294] binder: 23217:23222 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.303609] binder: 23217:23222 Release 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.303623] binder: 23217:23222 transaction failed 29189/-22, size 0-0 line 3119 [ 843.344650] binder: 23234:23238 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.344664] binder: 23234:23238 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.344786] binder: 23234:23238 Release 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.344800] binder: 23234:23238 transaction failed 29189/-22, size 0-0 line 3119 [ 843.361810] binder: 23231:23235 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.361822] binder: 23231:23235 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.406493] binder: 23244:23250 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.406507] binder: 23244:23250 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.406646] binder: 23244:23250 Release 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.406845] binder: 23244:23250 transaction failed 29189/-22, size 0-0 line 3119 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.415096] binder: 23248:23252 Acquire 1 refcount change on invalid ref 0 ret -22 [ 843.415110] binder: 23248:23252 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.453652] binder: 23261:23263 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.453665] binder: 23261:23263 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.488991] binder: 23269:23275 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.489003] binder: 23269:23275 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.489132] binder: 23269:23275 Release 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 843.489145] binder: 23269:23275 transaction failed 29189/-22, size 0-0 line 3119 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.521215] binder: 23281:23284 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.521228] binder: 23281:23284 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.521329] binder: 23281:23284 Release 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.521341] binder: 23281:23284 transaction failed 29189/-22, size 0-0 line 3119 [ 843.524900] binder: 23277:23280 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.524913] binder: 23277:23280 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.569459] binder: 23286:23292 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.569473] binder: 23286:23292 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.570045] binder: 23286:23292 Release 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.570057] binder: 23286:23292 transaction failed 29189/-22, size 0-0 line 3119 [ 843.603922] binder: 23295:23299 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.603936] binder: 23295:23299 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.644858] binder: 23307:23310 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.644872] binder: 23307:23310 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.644997] binder: 23307:23310 Release 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.645010] binder: 23307:23310 transaction failed 29189/-22, size 0-0 line 3119 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 843.667501] binder: 23314:23318 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.667679] binder: 23314:23318 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.687203] binder: 23322:23326 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.687214] binder: 23322:23326 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.687333] binder: 23322:23326 Release 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 843.687345] binder: 23322:23326 transaction failed 29189/-22, size 0-0 line 3119 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.724856] binder: 23330:23331 Acquire 1 refcount change on invalid ref 0 ret -22 [ 843.724869] binder: 23330:23331 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.725683] binder: 23330:23331 Release 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:24 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.725703] binder: 23330:23331 transaction failed 29189/-22, size 0-0 line 3119 [ 843.742568] binder: 23333:23336 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:24 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:24 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:24 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 843.742581] binder: 23333:23336 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.792059] binder: 23343:23351 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:24 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:24 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:24 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.792071] binder: 23343:23351 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:24 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:24 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.792182] binder: 23343:23351 Release 1 refcount change on invalid ref 0 ret -22 [ 843.792195] binder: 23343:23351 transaction failed 29189/-22, size 0-0 line 3119 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:24 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:24 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.807968] binder: 23353:23355 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:24 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.807980] binder: 23353:23355 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.835579] binder: 23363:23366 Acquire 1 refcount change on invalid ref 0 ret -22 [ 843.835591] binder: 23363:23366 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:24 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:24 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:24 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.859735] binder: 23367:23369 Acquire 1 refcount change on invalid ref 0 ret -22 [ 843.859748] binder: 23367:23369 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:24 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.859913] binder: 23367:23369 Release 1 refcount change on invalid ref 0 ret -22 [ 843.859926] binder: 23367:23369 transaction failed 29189/-22, size 0-0 line 3119 [ 843.911191] binder: 23376:23383 Acquire 1 refcount change on invalid ref 0 ret -22 [ 843.911206] binder: 23376:23383 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.915504] binder: 23381:23384 Acquire 1 refcount change on invalid ref 0 ret -22 [ 843.915517] binder: 23381:23384 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.915630] binder: 23381:23384 Release 1 refcount change on invalid ref 0 ret -22 [ 843.915643] binder: 23381:23384 transaction failed 29189/-22, size 0-0 line 3119 [ 843.943084] binder: 23391:23397 Acquire 1 refcount change on invalid ref 0 ret -22 [ 843.943104] binder: 23391:23397 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.994634] binder: 23400:23404 Acquire 1 refcount change on invalid ref 0 ret -22 [ 843.994648] binder: 23400:23404 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.994893] binder: 23400:23404 Release 1 refcount change on invalid ref 0 ret -22 [ 843.994906] binder: 23400:23404 transaction failed 29189/-22, size 0-0 line 3119 [ 844.003359] binder: 23403:23410 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.004575] binder: 23403:23410 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.038513] binder: 23418:23420 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.038527] binder: 23418:23420 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.093121] binder: 23417:23428 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.093134] binder: 23417:23428 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.093328] binder: 23417:23428 Release 1 refcount change on invalid ref 0 ret -22 [ 844.093340] binder: 23417:23428 transaction failed 29189/-22, size 0-0 line 3119 [ 844.112577] binder: 23435:23440 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.112596] binder: 23435:23440 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.142661] binder: 23439:23446 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.142674] binder: 23439:23446 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.142803] binder: 23439:23446 Release 1 refcount change on invalid ref 0 ret -22 [ 844.142815] binder: 23439:23446 transaction failed 29189/-22, size 0-0 line 3119 [ 844.183279] binder: 23450:23457 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.183293] binder: 23450:23457 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.203488] binder: 23456:23462 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.203501] binder: 23456:23462 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.203678] binder: 23456:23462 Release 1 refcount change on invalid ref 0 ret -22 [ 844.203691] binder: 23456:23462 transaction failed 29189/-22, size 0-0 line 3119 [ 844.249536] binder: 23470:23471 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.249550] binder: 23470:23471 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.249697] binder: 23470:23471 Release 1 refcount change on invalid ref 0 ret -22 [ 844.249710] binder: 23470:23471 transaction failed 29189/-22, size 0-0 line 3119 [ 844.263996] binder: 23464:23472 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.264010] binder: 23464:23472 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.305184] binder: 23481:23488 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.305198] binder: 23481:23488 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.316287] binder: 23484:23489 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.316301] binder: 23484:23489 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.316988] binder: 23484:23489 Release 1 refcount change on invalid ref 0 ret -22 [ 844.317002] binder: 23484:23489 transaction failed 29189/-22, size 0-0 line 3119 [ 844.438310] binder: 23499:23501 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.438324] binder: 23499:23501 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.443623] binder: 23499:23501 Release 1 refcount change on invalid ref 0 ret -22 [ 844.443636] binder: 23499:23501 transaction failed 29189/-22, size 0-0 line 3119 [ 844.482399] binder: 23504:23505 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.482412] binder: 23504:23505 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.513362] binder: 23508:23514 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.513376] binder: 23508:23514 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.513496] binder: 23508:23514 Release 1 refcount change on invalid ref 0 ret -22 [ 844.513509] binder: 23508:23514 transaction failed 29189/-22, size 0-0 line 3119 [ 844.572600] binder: 23522:23531 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.572614] binder: 23522:23531 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.590487] binder: 23536:23538 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.590501] binder: 23536:23538 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.590627] binder: 23536:23538 Release 1 refcount change on invalid ref 0 ret -22 [ 844.590641] binder: 23536:23538 transaction failed 29189/-22, size 0-0 line 3119 [ 844.625658] binder: 23542:23545 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.625678] binder: 23542:23545 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.640681] binder: 23549:23552 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.640695] binder: 23549:23552 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.640818] binder: 23549:23552 Release 1 refcount change on invalid ref 0 ret -22 [ 844.640831] binder: 23549:23552 transaction failed 29189/-22, size 0-0 line 3119 [ 844.675794] binder: 23556:23557 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.675807] binder: 23556:23557 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.713044] binder: 23559:23571 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.713058] binder: 23559:23571 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.713869] binder: 23559:23571 Release 1 refcount change on invalid ref 0 ret -22 [ 844.713881] binder: 23559:23571 transaction failed 29189/-22, size 0-0 line 3119 [ 844.739204] binder: 23566:23573 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.739219] binder: 23566:23573 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.776147] binder: 23582:23583 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.776160] binder: 23582:23583 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.776357] binder: 23582:23583 Release 1 refcount change on invalid ref 0 ret -22 [ 844.776370] binder: 23582:23583 transaction failed 29189/-22, size 0-0 line 3119 [ 844.809882] binder: 23586:23595 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.809895] binder: 23586:23595 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.821426] binder: 23592:23599 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.821438] binder: 23592:23599 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.822200] binder: 23592:23599 Release 1 refcount change on invalid ref 0 ret -22 [ 844.822213] binder: 23592:23599 transaction failed 29189/-22, size 0-0 line 3119 [ 844.868168] binder: 23601:23609 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.868182] binder: 23601:23609 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.908732] binder: 23607:23621 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.908746] binder: 23607:23621 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.908872] binder: 23607:23621 Release 1 refcount change on invalid ref 0 ret -22 [ 844.908896] binder: 23607:23621 transaction failed 29189/-22, size 0-0 line 3119 [ 844.930649] binder: 23616:23623 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.930662] binder: 23616:23623 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.967160] binder: 23627:23636 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.967172] binder: 23627:23636 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.967456] binder: 23627:23636 Release 1 refcount change on invalid ref 0 ret -22 [ 844.967470] binder: 23627:23636 transaction failed 29189/-22, size 0-0 line 3119 [ 844.985056] binder: 23631:23639 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.985068] binder: 23631:23639 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.022521] binder: 23643:23652 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.022534] binder: 23643:23652 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.025719] binder: 23643:23652 Release 1 refcount change on invalid ref 0 ret -22 [ 845.025732] binder: 23643:23652 transaction failed 29189/-22, size 0-0 line 3119 [ 845.053339] binder: 23647:23656 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.053353] binder: 23647:23656 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.089609] binder: 23659:23666 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.089623] binder: 23659:23666 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.089748] binder: 23659:23666 Release 1 refcount change on invalid ref 0 ret -22 [ 845.089761] binder: 23659:23666 transaction failed 29189/-22, size 0-0 line 3119 [ 845.136493] binder: 23668:23675 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.136506] binder: 23668:23675 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.161257] binder: 23677:23684 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.161269] binder: 23677:23684 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.161406] binder: 23677:23684 Release 1 refcount change on invalid ref 0 ret -22 [ 845.161419] binder: 23677:23684 transaction failed 29189/-22, size 0-0 line 3119 [ 845.201135] binder: 23688:23693 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.201149] binder: 23688:23693 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.217652] binder: 23691:23698 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.217674] binder: 23691:23698 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.219216] binder: 23691:23698 Release 1 refcount change on invalid ref 0 ret -22 [ 845.219229] binder: 23691:23698 transaction failed 29189/-22, size 0-0 line 3119 [ 845.266198] binder: 23704:23710 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.266211] binder: 23704:23710 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.272224] binder: 23708:23716 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.272236] binder: 23708:23716 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.272357] binder: 23708:23716 Release 1 refcount change on invalid ref 0 ret -22 [ 845.272371] binder: 23708:23716 transaction failed 29189/-22, size 0-0 line 3119 [ 845.325684] binder: 23721:23723 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.325697] binder: 23721:23723 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.348135] binder: 23726:23733 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.348148] binder: 23726:23733 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.348832] binder: 23726:23733 Release 1 refcount change on invalid ref 0 ret -22 [ 845.348846] binder: 23726:23733 transaction failed 29189/-22, size 0-0 line 3119 [ 845.385948] binder: 23735:23739 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.385961] binder: 23735:23739 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.417558] binder: 23746:23749 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.417571] binder: 23746:23749 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.417690] binder: 23746:23749 Release 1 refcount change on invalid ref 0 ret -22 [ 845.417702] binder: 23746:23749 transaction failed 29189/-22, size 0-0 line 3119 [ 845.442303] binder: 23750:23756 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.442317] binder: 23750:23756 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.481645] binder: 23759:23763 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.481658] binder: 23759:23763 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.481792] binder: 23759:23763 Release 1 refcount change on invalid ref 0 ret -22 [ 845.481806] binder: 23759:23763 transaction failed 29189/-22, size 0-0 line 3119 [ 845.495325] binder: 23766:23772 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.495337] binder: 23766:23772 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.556482] binder: 23778:23787 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.556494] binder: 23778:23787 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.561749] binder: 23776:23785 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.561761] binder: 23776:23785 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.561884] binder: 23776:23785 Release 1 refcount change on invalid ref 0 ret -22 [ 845.561898] binder: 23776:23785 transaction failed 29189/-22, size 0-0 line 3119 [ 845.617354] binder: 23797:23801 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.617367] binder: 23797:23801 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.617503] binder: 23797:23801 Release 1 refcount change on invalid ref 0 ret -22 [ 845.617517] binder: 23797:23801 transaction failed 29189/-22, size 0-0 line 3119 [ 845.631032] binder: 23802:23806 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.631045] binder: 23802:23806 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.681372] binder: 23811:23818 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.681394] binder: 23811:23818 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.681506] binder: 23811:23818 Release 1 refcount change on invalid ref 0 ret -22 [ 845.681519] binder: 23811:23818 transaction failed 29189/-22, size 0-0 line 3119 [ 845.695848] binder: 23817:23820 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.695861] binder: 23817:23820 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.733538] binder: 23828:23831 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.733551] binder: 23828:23831 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.733676] binder: 23828:23831 Release 1 refcount change on invalid ref 0 ret -22 [ 845.733688] binder: 23828:23831 transaction failed 29189/-22, size 0-0 line 3119 [ 845.753231] binder: 23835:23838 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.753245] binder: 23835:23838 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.763218] binder: 23840:23841 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.763231] binder: 23840:23841 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.763612] binder: 23840:23841 Release 1 refcount change on invalid ref 0 ret -22 [ 845.763627] binder: 23840:23841 transaction failed 29189/-22, size 0-0 line 3119 [ 845.795533] binder: 23843:23847 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.795547] binder: 23843:23847 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.823793] binder: 23852:23857 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.823805] binder: 23852:23857 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.824210] binder: 23852:23857 Release 1 refcount change on invalid ref 0 ret -22 [ 845.824223] binder: 23852:23857 transaction failed 29189/-22, size 0-0 line 3119 [ 845.860005] binder: 23859:23862 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.860020] binder: 23859:23862 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.889225] binder: 23867:23872 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.889237] binder: 23867:23872 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.889349] binder: 23867:23872 Release 1 refcount change on invalid ref 0 ret -22 [ 845.889362] binder: 23867:23872 transaction failed 29189/-22, size 0-0 line 3119 [ 845.933244] binder: 23877:23880 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.933257] binder: 23877:23880 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.963838] binder: 23886:23890 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.963851] binder: 23886:23890 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.965130] binder: 23886:23890 Release 1 refcount change on invalid ref 0 ret -22 [ 845.965143] binder: 23886:23890 transaction failed 29189/-22, size 0-0 line 3119 [ 845.996444] binder: 23893:23897 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.996456] binder: 23893:23897 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.021573] binder: 23899:23908 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.021586] binder: 23899:23908 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.021753] binder: 23899:23908 Release 1 refcount change on invalid ref 0 ret -22 [ 846.021766] binder: 23899:23908 transaction failed 29189/-22, size 0-0 line 3119 [ 846.052367] binder: 23909:23913 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.052389] binder: 23909:23913 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.114786] binder: 23924:23929 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.114799] binder: 23924:23929 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.114933] binder: 23924:23929 Release 1 refcount change on invalid ref 0 ret -22 [ 846.114946] binder: 23924:23929 transaction failed 29189/-22, size 0-0 line 3119 [ 846.137844] binder: 23927:23930 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.137857] binder: 23927:23930 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.139743] binder: 23934:23938 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.139755] binder: 23934:23938 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.140963] binder: 23934:23938 Release 1 refcount change on invalid ref 0 ret -22 [ 846.140976] binder: 23934:23938 transaction failed 29189/-22, size 0-0 line 3119 [ 846.192670] binder: 23945:23947 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.192683] binder: 23945:23947 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.193419] binder: 23945:23947 Release 1 refcount change on invalid ref 0 ret -22 [ 846.193433] binder: 23945:23947 transaction failed 29189/-22, size 0-0 line 3119 [ 846.195727] binder: 23946:23951 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.195739] binder: 23946:23951 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.246157] binder: 23958:23963 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.246171] binder: 23958:23963 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.246287] binder: 23958:23963 Release 1 refcount change on invalid ref 0 ret -22 [ 846.246300] binder: 23958:23963 transaction failed 29189/-22, size 0-0 line 3119 [ 846.248049] binder: 23959:23964 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.248061] binder: 23959:23964 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.311094] binder: 23977:23980 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.311114] binder: 23977:23980 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.312703] binder: 23976:23982 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.312715] binder: 23976:23982 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.312835] binder: 23976:23982 Release 1 refcount change on invalid ref 0 ret -22 [ 846.312847] binder: 23976:23982 transaction failed 29189/-22, size 0-0 line 3119 [ 846.368180] binder: 23992:23994 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.368192] binder: 23992:23994 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.371903] binder: 23992:23994 Release 1 refcount change on invalid ref 0 ret -22 [ 846.371917] binder: 23992:23994 transaction failed 29189/-22, size 0-0 line 3119 [ 846.402781] binder: 23990:24001 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.402794] binder: 23990:24001 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.429475] binder: 24005:24007 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.429488] binder: 24005:24007 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.429597] binder: 24005:24007 Release 1 refcount change on invalid ref 0 ret -22 [ 846.429610] binder: 24005:24007 transaction failed 29189/-22, size 0-0 line 3119 [ 846.468462] binder: 24012:24014 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.468475] binder: 24012:24014 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.482996] binder: 24017:24020 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.483008] binder: 24017:24020 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.483501] binder: 24017:24020 Release 1 refcount change on invalid ref 0 ret -22 [ 846.483515] binder: 24017:24020 transaction failed 29189/-22, size 0-0 line 3119 [ 846.524016] binder: 24029:24031 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.524030] binder: 24029:24031 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.533157] binder: 24032:24036 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.533171] binder: 24032:24036 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.533294] binder: 24032:24036 Release 1 refcount change on invalid ref 0 ret -22 [ 846.533307] binder: 24032:24036 transaction failed 29189/-22, size 0-0 line 3119 [ 846.578566] binder: 24045:24049 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.578579] binder: 24045:24049 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.579145] binder: 24045:24049 Release 1 refcount change on invalid ref 0 ret -22 [ 846.579159] binder: 24045:24049 transaction failed 29189/-22, size 0-0 line 3119 [ 846.585219] binder: 24043:24051 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.585232] binder: 24043:24051 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.649470] binder: 24059:24063 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.649482] binder: 24059:24063 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.650123] binder: 24059:24063 Release 1 refcount change on invalid ref 0 ret -22 [ 846.650137] binder: 24059:24063 transaction failed 29189/-22, size 0-0 line 3119 [ 846.671355] binder: 24061:24065 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.671370] binder: 24061:24065 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.713432] binder: 24072:24078 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.713446] binder: 24072:24078 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.713560] binder: 24072:24078 Release 1 refcount change on invalid ref 0 ret -22 [ 846.713573] binder: 24072:24078 transaction failed 29189/-22, size 0-0 line 3119 [ 846.741938] binder: 24085:24087 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.741949] binder: 24085:24087 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.790641] binder: 24089:24097 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.790654] binder: 24089:24097 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.790767] binder: 24089:24097 Release 1 refcount change on invalid ref 0 ret -22 [ 846.790779] binder: 24089:24097 transaction failed 29189/-22, size 0-0 line 3119 [ 846.801712] binder: 24096:24101 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.801724] binder: 24096:24101 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.839933] binder: 24109:24111 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.839946] binder: 24109:24111 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.840972] binder: 24109:24111 Release 1 refcount change on invalid ref 0 ret -22 [ 846.840985] binder: 24109:24111 transaction failed 29189/-22, size 0-0 line 3119 [ 846.863055] binder: 24113:24118 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.863068] binder: 24113:24118 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.886208] binder: 24120:24125 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.886221] binder: 24120:24125 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.886335] binder: 24120:24125 Release 1 refcount change on invalid ref 0 ret -22 [ 846.886362] binder: 24120:24125 transaction failed 29189/-22, size 0-0 line 3119 [ 846.928724] binder: 24130:24137 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.928736] binder: 24130:24137 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.928857] binder: 24130:24137 Release 1 refcount change on invalid ref 0 ret -22 [ 846.928870] binder: 24130:24137 transaction failed 29189/-22, size 0-0 line 3119 [ 846.933987] binder: 24131:24139 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.933999] binder: 24131:24139 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.994012] binder: 24144:24154 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.994025] binder: 24144:24154 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.994490] binder: 24144:24154 Release 1 refcount change on invalid ref 0 ret -22 [ 846.994502] binder: 24144:24154 transaction failed 29189/-22, size 0-0 line 3119 [ 847.019113] binder: 24150:24156 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.019126] binder: 24150:24156 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.068535] binder: 24162:24170 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.068549] binder: 24162:24170 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.068978] binder: 24162:24170 Release 1 refcount change on invalid ref 0 ret -22 [ 847.068990] binder: 24162:24170 transaction failed 29189/-22, size 0-0 line 3119 [ 847.085981] binder: 24174:24177 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.085993] binder: 24174:24177 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.106726] binder: 24178:24183 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.106739] binder: 24178:24183 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.107046] binder: 24178:24183 Release 1 refcount change on invalid ref 0 ret -22 [ 847.107059] binder: 24178:24183 transaction failed 29189/-22, size 0-0 line 3119 [ 847.135682] binder: 24184:24188 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.135695] binder: 24184:24188 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.156838] binder: 24190:24197 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.156850] binder: 24190:24197 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.157789] binder: 24190:24197 Release 1 refcount change on invalid ref 0 ret -22 [ 847.157802] binder: 24190:24197 transaction failed 29189/-22, size 0-0 line 3119 [ 847.199588] binder: 24202:24207 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.199602] binder: 24202:24207 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.202370] binder: 24202:24207 Release 1 refcount change on invalid ref 0 ret -22 [ 847.202393] binder: 24202:24207 transaction failed 29189/-22, size 0-0 line 3119 [ 847.223521] binder: 24205:24209 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.223534] binder: 24205:24209 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.278696] binder: 24218:24227 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.278709] binder: 24218:24227 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.279523] binder: 24218:24227 Release 1 refcount change on invalid ref 0 ret -22 [ 847.279537] binder: 24218:24227 transaction failed 29189/-22, size 0-0 line 3119 [ 847.284169] binder: 24222:24228 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.284182] binder: 24222:24228 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.335589] binder: 24235:24243 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.335602] binder: 24235:24243 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.367387] binder: 24248:24251 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.367402] binder: 24248:24251 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.394675] binder: 24241:24250 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.394687] binder: 24241:24250 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.394944] binder: 24241:24250 Release 1 refcount change on invalid ref 0 ret -22 [ 847.394956] binder: 24241:24250 transaction failed 29189/-22, size 0-0 line 3119 [ 847.438292] binder: 24261:24266 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.438306] binder: 24261:24266 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.444239] binder: 24263:24269 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.444253] binder: 24263:24269 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.444705] binder: 24263:24269 Release 1 refcount change on invalid ref 0 ret -22 [ 847.444718] binder: 24263:24269 transaction failed 29189/-22, size 0-0 line 3119 [ 847.491114] binder: 24277:24281 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.491126] binder: 24277:24281 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.520396] binder: 24279:24289 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.520411] binder: 24279:24289 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.521171] binder: 24279:24289 Release 1 refcount change on invalid ref 0 ret -22 [ 847.521187] binder: 24279:24289 transaction failed 29189/-22, size 0-0 line 3119 [ 847.531971] binder: 24286:24292 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.531984] binder: 24286:24292 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.582685] binder: 24298:24306 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.582712] binder: 24298:24306 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.586506] binder: 24298:24306 Release 1 refcount change on invalid ref 0 ret -22 [ 847.586519] binder: 24298:24306 transaction failed 29189/-22, size 0-0 line 3119 [ 847.597528] binder: 24304:24309 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.597541] binder: 24304:24309 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.664406] binder: 24316:24324 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.664420] binder: 24316:24324 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.664937] binder: 24312:24325 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.664949] binder: 24312:24325 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.665937] binder: 24312:24325 Release 1 refcount change on invalid ref 0 ret -22 [ 847.665950] binder: 24312:24325 transaction failed 29189/-22, size 0-0 line 3119 [ 847.744690] binder: 24337:24343 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.744710] binder: 24337:24343 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.749371] binder: 24335:24344 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.749393] binder: 24335:24344 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.749728] binder: 24335:24344 Release 1 refcount change on invalid ref 0 ret -22 [ 847.749742] binder: 24335:24344 transaction failed 29189/-22, size 0-0 line 3119 [ 847.811998] binder: 24355:24359 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.812011] binder: 24355:24359 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.812125] binder: 24355:24359 Release 1 refcount change on invalid ref 0 ret -22 [ 847.812139] binder: 24355:24359 transaction failed 29189/-22, size 0-0 line 3119 [ 847.821851] binder: 24353:24362 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.821865] binder: 24353:24362 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.872979] binder: 24369:24375 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.872992] binder: 24369:24375 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.873337] binder: 24369:24375 Release 1 refcount change on invalid ref 0 ret -22 [ 847.873351] binder: 24369:24375 transaction failed 29189/-22, size 0-0 line 3119 [ 847.895712] binder: 24373:24380 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.895725] binder: 24373:24380 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.939727] binder: 24385:24389 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.939740] binder: 24385:24389 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.939862] binder: 24385:24389 Release 1 refcount change on invalid ref 0 ret -22 [ 847.939875] binder: 24385:24389 transaction failed 29189/-22, size 0-0 line 3119 [ 847.972504] binder: 24394:24399 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.972519] binder: 24394:24399 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.974986] binder: 24400:24403 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.974998] binder: 24400:24403 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.975552] binder: 24400:24403 Release 1 refcount change on invalid ref 0 ret -22 [ 847.975566] binder: 24400:24403 transaction failed 29189/-22, size 0-0 line 3119 [ 848.030782] binder: 24408:24418 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.030795] binder: 24408:24418 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.030906] binder: 24408:24418 Release 1 refcount change on invalid ref 0 ret -22 [ 848.030919] binder: 24408:24418 transaction failed 29189/-22, size 0-0 line 3119 [ 848.044451] binder: 24413:24420 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.044463] binder: 24413:24420 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.090565] binder: 24422:24427 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.090577] binder: 24422:24427 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.090683] binder: 24422:24427 Release 1 refcount change on invalid ref 0 ret -22 [ 848.090695] binder: 24422:24427 transaction failed 29189/-22, size 0-0 line 3119 [ 848.102287] binder: 24428:24435 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.102300] binder: 24428:24435 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.124505] binder: 24438:24440 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.124518] binder: 24438:24440 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.124619] binder: 24438:24440 Release 1 refcount change on invalid ref 0 ret -22 [ 848.124632] binder: 24438:24440 transaction failed 29189/-22, size 0-0 line 3119 [ 848.167470] binder: 24445:24449 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.167484] binder: 24445:24449 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.172357] binder: 24448:24450 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.172369] binder: 24448:24450 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.172658] binder: 24448:24450 Release 1 refcount change on invalid ref 0 ret -22 [ 848.172671] binder: 24448:24450 transaction failed 29189/-22, size 0-0 line 3119 [ 848.225146] binder: 24459:24468 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.225159] binder: 24459:24468 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.225832] binder: 24459:24468 Release 1 refcount change on invalid ref 0 ret -22 [ 848.225845] binder: 24459:24468 transaction failed 29189/-22, size 0-0 line 3119 [ 848.231970] binder: 24460:24466 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.231982] binder: 24460:24466 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.292663] binder: 24478:24485 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.292676] binder: 24478:24485 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.292867] binder: 24474:24483 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.292879] binder: 24474:24483 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.293151] binder: 24478:24485 Release 1 refcount change on invalid ref 0 ret -22 [ 848.293164] binder: 24478:24485 transaction failed 29189/-22, size 0-0 line 3119 [ 848.346171] binder: 24490:24496 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.346184] binder: 24490:24496 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.377007] binder: 24493:24501 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.377020] binder: 24493:24501 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.396224] binder: 24493:24501 Release 1 refcount change on invalid ref 0 ret -22 [ 848.396239] binder: 24493:24501 transaction failed 29189/-22, size 0-0 line 3119 [ 848.413449] binder: 24505:24512 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.413464] binder: 24505:24512 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.437937] binder: 24513:24518 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.437951] binder: 24513:24518 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.438080] binder: 24513:24518 Release 1 refcount change on invalid ref 0 ret -22 [ 848.438093] binder: 24513:24518 transaction failed 29189/-22, size 0-0 line 3119 [ 848.456080] binder: 24519:24523 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.456093] binder: 24519:24523 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.485784] binder: 24530:24533 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.485798] binder: 24530:24533 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.486404] binder: 24530:24533 Release 1 refcount change on invalid ref 0 ret -22 [ 848.486418] binder: 24530:24533 transaction failed 29189/-22, size 0-0 line 3119 [ 848.540116] binder: 24537:24542 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.540130] binder: 24537:24542 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.555305] binder: 24546:24549 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.555317] binder: 24546:24549 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.555427] binder: 24546:24549 Release 1 refcount change on invalid ref 0 ret -22 [ 848.555441] binder: 24546:24549 transaction failed 29189/-22, size 0-0 line 3119 [ 848.592857] binder: 24555:24559 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.592871] binder: 24555:24559 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.621996] binder: 24560:24565 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.622009] binder: 24560:24565 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.622167] binder: 24560:24565 Release 1 refcount change on invalid ref 0 ret -22 [ 848.622180] binder: 24560:24565 transaction failed 29189/-22, size 0-0 line 3119 [ 848.661679] binder: 24570:24573 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.661692] binder: 24570:24573 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.689498] binder: 24576:24587 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.689511] binder: 24576:24587 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.690152] binder: 24576:24587 Release 1 refcount change on invalid ref 0 ret -22 [ 848.690166] binder: 24576:24587 transaction failed 29189/-22, size 0-0 line 3119 [ 848.721550] binder: 24585:24589 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.721563] binder: 24585:24589 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.750506] binder: 24595:24601 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.750518] binder: 24595:24601 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.751267] binder: 24595:24601 Release 1 refcount change on invalid ref 0 ret -22 [ 848.751281] binder: 24595:24601 transaction failed 29189/-22, size 0-0 line 3119 [ 848.777465] binder: 24604:24607 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.777478] binder: 24604:24607 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.809889] binder: 24615:24619 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.809902] binder: 24615:24619 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.810015] binder: 24615:24619 Release 1 refcount change on invalid ref 0 ret -22 [ 848.810028] binder: 24615:24619 transaction failed 29189/-22, size 0-0 line 3119 [ 848.819207] binder: 24613:24620 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.819219] binder: 24613:24620 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.869105] binder: 24630:24632 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.869119] binder: 24630:24632 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.869328] binder: 24630:24632 Release 1 refcount change on invalid ref 0 ret -22 [ 848.869342] binder: 24630:24632 transaction failed 29189/-22, size 0-0 line 3119 [ 848.869630] binder: 24629:24633 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.869643] binder: 24629:24633 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.935204] binder: 24644:24648 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.935217] binder: 24644:24648 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.935386] binder: 24644:24648 Release 1 refcount change on invalid ref 0 ret -22 [ 848.935400] binder: 24644:24648 transaction failed 29189/-22, size 0-0 line 3119 [ 848.941061] binder: 24645:24654 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.941073] binder: 24645:24654 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.990591] binder: 24660:24664 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.990605] binder: 24660:24664 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.991535] binder: 24660:24664 Release 1 refcount change on invalid ref 0 ret -22 [ 848.991556] binder: 24660:24664 transaction failed 29189/-22, size 0-0 line 3119 [ 849.013316] binder: 24661:24673 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.013329] binder: 24661:24673 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.061100] binder: 24675:24686 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.061113] binder: 24675:24686 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.061224] binder: 24675:24686 Release 1 refcount change on invalid ref 0 ret -22 [ 849.061237] binder: 24675:24686 transaction failed 29189/-22, size 0-0 line 3119 [ 849.063619] binder: 24682:24687 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.063631] binder: 24682:24687 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.136172] binder: 24697:24705 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.136186] binder: 24697:24705 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.136298] binder: 24697:24705 Release 1 refcount change on invalid ref 0 ret -22 [ 849.136311] binder: 24697:24705 transaction failed 29189/-22, size 0-0 line 3119 [ 849.143949] binder: 24702:24708 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.143960] binder: 24702:24708 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.174956] binder: 24713:24717 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.174969] binder: 24713:24717 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.190948] binder: 24712:24715 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.190961] binder: 24712:24715 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.193925] binder: 24712:24715 Release 1 refcount change on invalid ref 0 ret -22 [ 849.193949] binder: 24712:24715 transaction failed 29189/-22, size 0-0 line 3119 [ 849.260321] binder: 24725:24736 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.260334] binder: 24725:24736 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.264655] binder: 24731:24738 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.264666] binder: 24731:24738 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.264792] binder: 24731:24738 Release 1 refcount change on invalid ref 0 ret -22 [ 849.264804] binder: 24731:24738 transaction failed 29189/-22, size 0-0 line 3119 [ 849.320036] binder: 24747:24752 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.320049] binder: 24747:24752 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.320167] binder: 24747:24752 Release 1 refcount change on invalid ref 0 ret -22 [ 849.320180] binder: 24747:24752 transaction failed 29189/-22, size 0-0 line 3119 [ 849.338065] binder: 24749:24753 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.338078] binder: 24749:24753 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.388931] binder: 24762:24765 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.388944] binder: 24762:24765 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.389057] binder: 24762:24765 Release 1 refcount change on invalid ref 0 ret -22 [ 849.389072] binder: 24762:24765 transaction failed 29189/-22, size 0-0 line 3119 [ 849.426255] binder: 24768:24776 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.426268] binder: 24768:24776 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.435848] binder: 24775:24783 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.435860] binder: 24775:24783 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.437110] binder: 24775:24783 Release 1 refcount change on invalid ref 0 ret -22 [ 849.437124] binder: 24775:24783 transaction failed 29189/-22, size 0-0 line 3119 [ 849.478565] binder: 24787:24789 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.478578] binder: 24787:24789 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.490314] binder: 24791:24795 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.490326] binder: 24791:24795 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.490436] binder: 24791:24795 Release 1 refcount change on invalid ref 0 ret -22 [ 849.490448] binder: 24791:24795 transaction failed 29189/-22, size 0-0 line 3119 [ 849.542643] binder: 24800:24805 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.542656] binder: 24800:24805 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.559294] binder: 24803:24810 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.559318] binder: 24803:24810 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.559945] binder: 24803:24810 Release 1 refcount change on invalid ref 0 ret -22 [ 849.559958] binder: 24803:24810 transaction failed 29189/-22, size 0-0 line 3119 [ 849.603898] binder: 24819:24824 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.603911] binder: 24819:24824 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.604027] binder: 24819:24824 Release 1 refcount change on invalid ref 0 ret -22 [ 849.604040] binder: 24819:24824 transaction failed 29189/-22, size 0-0 line 3119 [ 849.616050] binder: 24815:24821 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.616063] binder: 24815:24821 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.651093] binder: 24831:24837 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.651106] binder: 24831:24837 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.651836] binder: 24831:24837 Release 1 refcount change on invalid ref 0 ret -22 [ 849.651850] binder: 24831:24837 transaction failed 29189/-22, size 0-0 line 3119 [ 849.655769] binder: 24835:24838 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.655781] binder: 24835:24838 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.712820] binder: 24842:24853 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.712832] binder: 24842:24853 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.713449] binder: 24842:24853 Release 1 refcount change on invalid ref 0 ret -22 [ 849.713462] binder: 24842:24853 transaction failed 29189/-22, size 0-0 line 3119 [ 849.720831] binder: 24847:24857 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.720843] binder: 24847:24857 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.760586] binder: 24860:24865 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.760599] binder: 24860:24865 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.761208] binder: 24860:24865 Release 1 refcount change on invalid ref 0 ret -22 [ 849.761302] binder: 24860:24865 transaction failed 29189/-22, size 0-0 line 3119 [ 849.794009] binder: 24868:24871 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.794022] binder: 24868:24871 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.842934] binder: 24877:24882 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.842948] binder: 24877:24882 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.843059] binder: 24877:24882 Release 1 refcount change on invalid ref 0 ret -22 [ 849.843072] binder: 24877:24882 transaction failed 29189/-22, size 0-0 line 3119 [ 849.845228] binder: 24881:24889 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.845241] binder: 24881:24889 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.911762] binder: 24898:24902 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.911775] binder: 24898:24902 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.916007] binder: 24896:24903 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.916020] binder: 24896:24903 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.916163] binder: 24896:24903 Release 1 refcount change on invalid ref 0 ret -22 [ 849.916188] binder: 24896:24903 transaction failed 29189/-22, size 0-0 line 3119 [ 849.989473] binder: 24916:24925 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.989487] binder: 24916:24925 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.991366] binder: 24917:24926 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.991386] binder: 24917:24926 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.991506] binder: 24917:24926 Release 1 refcount change on invalid ref 0 ret -22 [ 849.991519] binder: 24917:24926 transaction failed 29189/-22, size 0-0 line 3119 [ 850.042981] binder: 24931:24940 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.042994] binder: 24931:24940 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.043191] binder: 24931:24940 Release 1 refcount change on invalid ref 0 ret -22 [ 850.043204] binder: 24931:24940 transaction failed 29189/-22, size 0-0 line 3119 [ 850.046038] binder: 24933:24941 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.046052] binder: 24933:24941 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.090903] binder: 24946:24950 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.090915] binder: 24946:24950 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.091093] binder: 24947:24951 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.091105] binder: 24947:24951 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.091553] binder: 24946:24950 Release 1 refcount change on invalid ref 0 ret -22 [ 850.091566] binder: 24946:24950 transaction failed 29189/-22, size 0-0 line 3119 [ 850.164104] binder: 24963:24969 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.164117] binder: 24963:24969 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.164478] binder: 24961:24970 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.164490] binder: 24961:24970 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.164615] binder: 24961:24970 Release 1 refcount change on invalid ref 0 ret -22 [ 850.164628] binder: 24961:24970 transaction failed 29189/-22, size 0-0 line 3119 [ 850.232391] binder: 24979:24984 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.232405] binder: 24979:24984 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.233834] binder: 24979:24984 Release 1 refcount change on invalid ref 0 ret -22 [ 850.233847] binder: 24979:24984 transaction failed 29189/-22, size 0-0 line 3119 [ 850.242616] binder: 24976:24986 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.242629] binder: 24976:24986 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.315483] binder: 25000:25003 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.315498] binder: 25000:25003 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.319357] binder: 24994:25001 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.319370] binder: 24994:25001 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.319515] binder: 24994:25001 Release 1 refcount change on invalid ref 0 ret -22 [ 850.319530] binder: 24994:25001 transaction failed 29189/-22, size 0-0 line 3119 [ 850.347338] binder: 25009:25014 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.347351] binder: 25009:25014 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.347461] binder: 25009:25014 Release 1 refcount change on invalid ref 0 ret -22 [ 850.347474] binder: 25009:25014 transaction failed 29189/-22, size 0-0 line 3119 [ 850.388930] binder: 25015:25018 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.388943] binder: 25015:25018 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.404305] binder: 25020:25028 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.404318] binder: 25020:25028 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.405086] binder: 25020:25028 Release 1 refcount change on invalid ref 0 ret -22 [ 850.405100] binder: 25020:25028 transaction failed 29189/-22, size 0-0 line 3119 [ 850.444826] binder: 25031:25036 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.444839] binder: 25031:25036 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.481813] binder: 25037:25044 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.481826] binder: 25037:25044 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.482728] binder: 25037:25044 Release 1 refcount change on invalid ref 0 ret -22 [ 850.482741] binder: 25037:25044 transaction failed 29189/-22, size 0-0 line 3119 [ 850.510547] binder: 25045:25051 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.510561] binder: 25045:25051 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.544965] binder: 25064:25066 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.544979] binder: 25064:25066 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.549640] binder: 25059:25065 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.549652] binder: 25059:25065 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.551868] binder: 25059:25065 Release 1 refcount change on invalid ref 0 ret -22 [ 850.551891] binder: 25059:25065 transaction failed 29189/-22, size 0-0 line 3119 [ 850.592007] binder: 25072:25076 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.592020] binder: 25072:25076 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.608418] binder: 25080:25082 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.608431] binder: 25080:25082 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.608567] binder: 25080:25082 Release 1 refcount change on invalid ref 0 ret -22 [ 850.608580] binder: 25080:25082 transaction failed 29189/-22, size 0-0 line 3119 [ 850.653432] binder: 25084:25090 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.653444] binder: 25084:25090 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.678414] binder: 25093:25099 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.678427] binder: 25093:25099 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.678557] binder: 25093:25099 Release 1 refcount change on invalid ref 0 ret -22 [ 850.678569] binder: 25093:25099 transaction failed 29189/-22, size 0-0 line 3119 [ 850.710563] binder: 25104:25107 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.710575] binder: 25104:25107 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.747078] binder: 25109:25116 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.747093] binder: 25109:25116 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.747210] binder: 25109:25116 Release 1 refcount change on invalid ref 0 ret -22 [ 850.747224] binder: 25109:25116 transaction failed 29189/-22, size 0-0 line 3119 [ 850.773086] binder: 25118:25123 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.773099] binder: 25118:25123 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.811956] binder: 25131:25136 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.811969] binder: 25131:25136 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.812413] binder: 25131:25136 Release 1 refcount change on invalid ref 0 ret -22 [ 850.812426] binder: 25131:25136 transaction failed 29189/-22, size 0-0 line 3119 [ 850.855150] binder: 25135:25144 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.855163] binder: 25135:25144 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.881186] binder: 25149:25153 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.881199] binder: 25149:25153 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.881328] binder: 25149:25153 Release 1 refcount change on invalid ref 0 ret -22 [ 850.881342] binder: 25149:25153 transaction failed 29189/-22, size 0-0 line 3119 [ 850.926760] binder: 25155:25163 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.926774] binder: 25155:25163 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.974476] binder: 25173:25176 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.974488] binder: 25173:25176 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.975441] binder: 25167:25170 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.975552] binder: 25167:25170 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.976314] binder: 25167:25170 Release 1 refcount change on invalid ref 0 ret -22 [ 850.976514] binder: 25167:25170 transaction failed 29189/-22, size 0-0 line 3119 [ 851.032329] binder: 25185:25190 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.032341] binder: 25185:25190 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.032466] binder: 25185:25190 Release 1 refcount change on invalid ref 0 ret -22 [ 851.032479] binder: 25185:25190 transaction failed 29189/-22, size 0-0 line 3119 [ 851.079524] binder: 25186:25195 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.079537] binder: 25186:25195 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.107031] binder: 25199:25209 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.107043] binder: 25199:25209 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.107171] binder: 25199:25209 Release 1 refcount change on invalid ref 0 ret -22 [ 851.107182] binder: 25199:25209 transaction failed 29189/-22, size 0-0 line 3119 [ 851.136081] binder: 25211:25215 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.136093] binder: 25211:25215 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.169917] binder: 25218:25222 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.169930] binder: 25218:25222 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.170062] binder: 25218:25222 Release 1 refcount change on invalid ref 0 ret -22 [ 851.170075] binder: 25218:25222 transaction failed 29189/-22, size 0-0 line 3119 [ 851.194179] binder: 25227:25231 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.194193] binder: 25227:25231 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.236672] binder: 25232:25238 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.236684] binder: 25232:25238 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.236818] binder: 25232:25238 Release 1 refcount change on invalid ref 0 ret -22 [ 851.236831] binder: 25232:25238 transaction failed 29189/-22, size 0-0 line 3119 [ 851.249304] binder: 25239:25244 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.249317] binder: 25239:25244 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.305548] binder: 25252:25261 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.305561] binder: 25252:25261 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.305672] binder: 25252:25261 Release 1 refcount change on invalid ref 0 ret -22 [ 851.305684] binder: 25252:25261 transaction failed 29189/-22, size 0-0 line 3119 [ 851.322232] binder: 25254:25264 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.322244] binder: 25254:25264 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.367928] binder: 25269:25272 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.367941] binder: 25269:25272 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.368057] binder: 25269:25272 Release 1 refcount change on invalid ref 0 ret -22 [ 851.368070] binder: 25269:25272 transaction failed 29189/-22, size 0-0 line 3119 [ 851.401087] binder: 25274:25283 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.401098] binder: 25274:25283 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.405694] binder: 25277:25287 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.405706] binder: 25277:25287 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.405824] binder: 25277:25287 Release 1 refcount change on invalid ref 0 ret -22 [ 851.405837] binder: 25277:25287 transaction failed 29189/-22, size 0-0 line 3119 [ 851.480929] binder: 25294:25304 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.480942] binder: 25294:25304 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.492065] binder: 25299:25306 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.492078] binder: 25299:25306 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.492189] binder: 25299:25306 Release 1 refcount change on invalid ref 0 ret -22 [ 851.492202] binder: 25299:25306 transaction failed 29189/-22, size 0-0 line 3119 [ 851.535882] binder: 25313:25319 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.535895] binder: 25313:25319 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.536028] binder: 25313:25319 Release 1 refcount change on invalid ref 0 ret -22 [ 851.536042] binder: 25313:25319 transaction failed 29189/-22, size 0-0 line 3119 [ 851.542147] binder: 25316:25322 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.542159] binder: 25316:25322 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.604990] binder: 25327:25335 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.605250] binder: 25327:25335 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.633824] binder: 25332:25337 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.633836] binder: 25332:25337 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.639869] binder: 25332:25337 Release 1 refcount change on invalid ref 0 ret -22 [ 851.639883] binder: 25332:25337 transaction failed 29189/-22, size 0-0 line 3119 [ 851.665161] binder: 25346:25352 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.665174] binder: 25346:25352 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.673928] binder: 25349:25354 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.673940] binder: 25349:25354 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.674050] binder: 25349:25354 Release 1 refcount change on invalid ref 0 ret -22 [ 851.674063] binder: 25349:25354 transaction failed 29189/-22, size 0-0 line 3119 [ 851.725006] binder: 25362:25364 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.725074] binder: 25362:25364 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.728454] binder: 25363:25366 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.728466] binder: 25363:25366 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 851.728806] binder: 25363:25366 Release 1 refcount change on invalid ref 0 ret -22 [ 851.728818] binder: 25363:25366 transaction failed 29189/-22, size 0-0 line 3119 [ 857.311222] binder: undelivered TRANSACTION_ERROR: 29189 [ 857.331057] binder: undelivered TRANSACTION_ERROR: 29189 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 857.337870] binder: 25376:25377 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 857.337891] binder: 25376:25377 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 857.338065] binder: 25374:25378 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 857.338075] binder: 25374:25378 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 857.338353] binder: 25376:25377 Release 1 refcount change on invalid ref 0 ret -22 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 857.338368] binder: 25376:25377 transaction failed 29189/-22, size 0-0 line 3119 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 857.383414] binder: 25381:25387 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 857.383427] binder: 25381:25387 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 857.405945] binder: 25388:25390 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 857.405958] binder: 25388:25390 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.406084] binder: 25388:25390 Release 1 refcount change on invalid ref 0 ret -22 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 857.406097] binder: 25388:25390 transaction failed 29189/-22, size 0-0 line 3119 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 857.453688] binder: 25399:25404 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 857.453701] binder: 25399:25404 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 857.466602] binder: 25403:25409 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 857.466617] binder: 25403:25409 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 857.466743] binder: 25403:25409 Release 1 refcount change on invalid ref 0 ret -22 [ 857.466756] binder: 25403:25409 transaction failed 29189/-22, size 0-0 line 3119 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 857.496327] binder: 25415:25418 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 857.496391] binder: 25415:25418 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 857.524325] binder: 25421:25426 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 857.524337] binder: 25421:25426 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.524459] binder: 25421:25426 Release 1 refcount change on invalid ref 0 ret -22 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 857.524472] binder: 25421:25426 transaction failed 29189/-22, size 0-0 line 3119 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 857.555056] binder: 25428:25435 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.555069] binder: 25428:25435 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 857.605598] binder: 25440:25448 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.605611] binder: 25440:25448 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 857.605834] binder: 25437:25446 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 857.605846] binder: 25437:25446 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 857.605968] binder: 25437:25446 Release 1 refcount change on invalid ref 0 ret -22 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 857.605989] binder: 25437:25446 transaction failed 29189/-22, size 0-0 line 3119 [ 857.661114] binder: 25456:25462 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.661127] binder: 25456:25462 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 857.661255] binder: 25456:25462 Release 1 refcount change on invalid ref 0 ret -22 [ 857.661268] binder: 25456:25462 transaction failed 29189/-22, size 0-0 line 3119 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 857.662453] binder: 25452:25463 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.662466] binder: 25452:25463 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.734068] binder: 25469:25480 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.734081] binder: 25469:25480 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 857.759252] binder: 25471:25481 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.759265] binder: 25471:25481 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:32 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:32 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:32 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:32 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:32 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 857.759438] binder: 25471:25481 Release 1 refcount change on invalid ref 0 ret -22 [ 857.759451] binder: 25471:25481 transaction failed 29189/-22, size 0-0 line 3119 [ 857.817543] binder: 25490:25498 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.817557] binder: 25490:25498 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.825156] binder: 25493:25502 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.825169] binder: 25493:25502 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.825298] binder: 25493:25502 Release 1 refcount change on invalid ref 0 ret -22 [ 857.825312] binder: 25493:25502 transaction failed 29189/-22, size 0-0 line 3119 [ 857.880985] binder: 25513:25517 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.880998] binder: 25513:25517 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.883211] binder: 25508:25514 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.883222] binder: 25508:25514 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.883332] binder: 25508:25514 Release 1 refcount change on invalid ref 0 ret -22 [ 857.883346] binder: 25508:25514 transaction failed 29189/-22, size 0-0 line 3119 [ 857.936821] binder: 25527:25529 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.936833] binder: 25527:25529 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.941304] binder: 25525:25532 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.941316] binder: 25525:25532 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.941452] binder: 25525:25532 Release 1 refcount change on invalid ref 0 ret -22 [ 857.941466] binder: 25525:25532 transaction failed 29189/-22, size 0-0 line 3119 [ 857.994391] binder: 25538:25544 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.994405] binder: 25538:25544 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.004319] binder: 25542:25548 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.004331] binder: 25542:25548 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.004457] binder: 25542:25548 Release 1 refcount change on invalid ref 0 ret -22 [ 858.004471] binder: 25542:25548 transaction failed 29189/-22, size 0-0 line 3119 [ 858.058947] binder: 25555:25561 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.058960] binder: 25555:25561 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.059579] binder: 25555:25561 Release 1 refcount change on invalid ref 0 ret -22 [ 858.059598] binder: 25555:25561 transaction failed 29189/-22, size 0-0 line 3119 [ 858.071875] binder: 25557:25564 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.071887] binder: 25557:25564 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.090891] binder: 25568:25571 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.090904] binder: 25568:25571 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.091016] binder: 25568:25571 Release 1 refcount change on invalid ref 0 ret -22 [ 858.091029] binder: 25568:25571 transaction failed 29189/-22, size 0-0 line 3119 [ 858.140211] binder: 25574:25583 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.140224] binder: 25574:25583 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.160093] binder: 25579:25585 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.160106] binder: 25579:25585 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.160234] binder: 25579:25585 Release 1 refcount change on invalid ref 0 ret -22 [ 858.160248] binder: 25579:25585 transaction failed 29189/-22, size 0-0 line 3119 [ 858.214508] binder: 25590:25597 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.214521] binder: 25590:25597 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.230365] binder: 25594:25603 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.230379] binder: 25594:25603 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.230503] binder: 25594:25603 Release 1 refcount change on invalid ref 0 ret -22 [ 858.230516] binder: 25594:25603 transaction failed 29189/-22, size 0-0 line 3119 [ 858.263602] binder: 25609:25612 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.263615] binder: 25609:25612 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.306474] binder: 25615:25623 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.306492] binder: 25615:25623 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.308729] binder: 25615:25623 Release 1 refcount change on invalid ref 0 ret -22 [ 858.308748] binder: 25615:25623 transaction failed 29189/-22, size 0-0 line 3119 [ 858.320319] binder: 25619:25625 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.320332] binder: 25619:25625 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.379064] binder: 25630:25640 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.379077] binder: 25630:25640 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.379203] binder: 25630:25640 Release 1 refcount change on invalid ref 0 ret -22 [ 858.379217] binder: 25630:25640 transaction failed 29189/-22, size 0-0 line 3119 [ 858.382130] binder: 25637:25641 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.382144] binder: 25637:25641 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.433724] binder: 25649:25654 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.433738] binder: 25649:25654 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.459691] binder: 25653:25658 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.459704] binder: 25653:25658 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.461467] binder: 25653:25658 Release 1 refcount change on invalid ref 0 ret -22 [ 858.461481] binder: 25653:25658 transaction failed 29189/-22, size 0-0 line 3119 [ 858.501090] binder: 25664:25669 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.501104] binder: 25664:25669 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.515130] binder: 25671:25675 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.515143] binder: 25671:25675 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.515241] binder: 25671:25675 Release 1 refcount change on invalid ref 0 ret -22 [ 858.515253] binder: 25671:25675 transaction failed 29189/-22, size 0-0 line 3119 [ 858.564335] binder: 25680:25686 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.564349] binder: 25680:25686 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.578640] binder: 25681:25689 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.578653] binder: 25681:25689 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.578997] binder: 25681:25689 Release 1 refcount change on invalid ref 0 ret -22 [ 858.579011] binder: 25681:25689 transaction failed 29189/-22, size 0-0 line 3119 [ 858.623750] binder: 25695:25700 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.623763] binder: 25695:25700 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.627013] binder: 25698:25703 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.627025] binder: 25698:25703 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.627134] binder: 25698:25703 Release 1 refcount change on invalid ref 0 ret -22 [ 858.627147] binder: 25698:25703 transaction failed 29189/-22, size 0-0 line 3119 [ 858.674467] binder: 25710:25717 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.674481] binder: 25710:25717 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.691934] binder: 25713:25718 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.691948] binder: 25713:25718 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.702210] binder: 25713:25718 Release 1 refcount change on invalid ref 0 ret -22 [ 858.702225] binder: 25713:25718 transaction failed 29189/-22, size 0-0 line 3119 [ 858.725607] binder: 25726:25728 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.725631] binder: 25726:25728 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.751254] binder: 25729:25734 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.751267] binder: 25729:25734 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.751377] binder: 25729:25734 Release 1 refcount change on invalid ref 0 ret -22 [ 858.751389] binder: 25729:25734 transaction failed 29189/-22, size 0-0 line 3119 [ 858.785402] binder: 25735:25739 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.785415] binder: 25735:25739 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.811552] binder: 25745:25749 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.811565] binder: 25745:25749 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.811689] binder: 25745:25749 Release 1 refcount change on invalid ref 0 ret -22 [ 858.811701] binder: 25745:25749 transaction failed 29189/-22, size 0-0 line 3119 [ 858.853563] binder: 25750:25759 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.853576] binder: 25750:25759 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.862619] binder: 25760:25762 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.862632] binder: 25760:25762 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.862751] binder: 25760:25762 Release 1 refcount change on invalid ref 0 ret -22 [ 858.862763] binder: 25760:25762 transaction failed 29189/-22, size 0-0 line 3119 [ 858.913366] binder: 25767:25772 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.913379] binder: 25767:25772 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.924004] binder: 25770:25779 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.924017] binder: 25770:25779 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.925015] binder: 25770:25779 Release 1 refcount change on invalid ref 0 ret -22 [ 858.925029] binder: 25770:25779 transaction failed 29189/-22, size 0-0 line 3119 [ 859.000098] binder: 25786:25789 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.000111] binder: 25786:25789 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.012569] binder: 25786:25789 Release 1 refcount change on invalid ref 0 ret -22 [ 859.012583] binder: 25786:25789 transaction failed 29189/-22, size 0-0 line 3119 [ 859.029176] binder: 25790:25795 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.029189] binder: 25790:25795 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.073553] binder: 25801:25805 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.073566] binder: 25801:25805 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.073867] binder: 25801:25805 Release 1 refcount change on invalid ref 0 ret -22 [ 859.073889] binder: 25801:25805 transaction failed 29189/-22, size 0-0 line 3119 [ 859.074011] binder: 25799:25804 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.074025] binder: 25799:25804 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.147888] binder: 25813:25817 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.147901] binder: 25813:25817 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.156290] binder: 25811:25820 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.156303] binder: 25811:25820 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.157716] binder: 25811:25820 Release 1 refcount change on invalid ref 0 ret -22 [ 859.157730] binder: 25811:25820 transaction failed 29189/-22, size 0-0 line 3119 [ 859.201439] binder: 25827:25830 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.201453] binder: 25827:25830 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.205998] binder: 25829:25834 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.206011] binder: 25829:25834 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.207105] binder: 25829:25834 Release 1 refcount change on invalid ref 0 ret -22 [ 859.207118] binder: 25829:25834 transaction failed 29189/-22, size 0-0 line 3119 [ 859.248930] binder: 25839:25843 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.248943] binder: 25839:25843 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.249069] binder: 25839:25843 Release 1 refcount change on invalid ref 0 ret -22 [ 859.249082] binder: 25839:25843 transaction failed 29189/-22, size 0-0 line 3119 [ 859.256731] binder: 25841:25845 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.256744] binder: 25841:25845 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.286517] binder: 25850:25854 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.286529] binder: 25850:25854 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.287593] binder: 25850:25854 Release 1 refcount change on invalid ref 0 ret -22 [ 859.287606] binder: 25850:25854 transaction failed 29189/-22, size 0-0 line 3119 [ 859.291947] INFO: task kworker/u4:4:2137 blocked for more than 140 seconds. [ 859.291958] Not tainted 4.9.185+ #7 [ 859.291981] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 859.291999] kworker/u4:4 D25560 2137 2 0x80000000 [ 859.292017] Workqueue: events_unbound fsnotify_mark_destroy_workfn [ 859.292031] 0000000000000087 ffff8801cfeeaf80 0000000000000000 ffff8801db721000 [ 859.292046] ffff8801da6817c0 ffff8801db721018 ffff8801cf0af730 ffffffff8280a47e [ 859.292056] 0000000000000000 0000000000000376 0000000000000002 ffff8801db7218f0 [ 859.292058] Call Trace: [ 859.292071] [<00000000b5500576>] ? __schedule+0x6ce/0x1f10 [ 859.292080] [<000000007b41def8>] ? io_schedule_timeout+0x390/0x390 [ 859.292088] [<00000000a7137b8f>] schedule+0x92/0x1c0 [ 859.292102] [<00000000c7977768>] schedule_timeout+0x766/0xe50 [ 859.292113] [<0000000042f242e4>] ? check_preemption_disabled+0x3c/0x200 [ 859.292121] [<000000005741e9ad>] ? usleep_range+0x140/0x140 [ 859.292130] [<000000005c7d4a14>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 859.292151] [<000000000982c608>] ? mark_held_locks+0xb1/0x100 [ 859.292159] [<000000009f84c565>] ? wait_for_common+0xad/0x4d0 [ 859.292167] [<0000000015a333c1>] ? _raw_spin_unlock_irq+0x28/0x60 [ 859.292175] [<000000006fed4864>] ? trace_hardirqs_on_caller+0x385/0x5a0 [ 859.292191] [<0000000023b1e614>] wait_for_common+0x2c6/0x4d0 [ 859.292216] [<000000008edef1e9>] ? out_of_line_wait_on_atomic_t+0x200/0x200 [ 859.292224] [<00000000b4c662eb>] ? wake_up_q+0xf0/0xf0 [ 859.292232] [<000000007ffab1aa>] ? srcu_reschedule+0x82/0x340 [ 859.292251] [<0000000061d148ae>] ? srcu_advance_batches+0x1e3/0x430 [ 859.292259] [<00000000ac356893>] wait_for_completion+0x18/0x20 [ 859.292267] [<00000000f3a5a7fb>] __synchronize_srcu+0x26d/0x3d0 [ 859.292284] [<00000000808c37e4>] ? srcu_advance_batches+0x430/0x430 [ 859.292295] [<00000000469a49ae>] ? trace_raw_output_rcu_utilization+0x150/0x150 [ 859.292304] [<000000004cdcc8fc>] ? fsnotify_mark_destroy_list+0x80/0x390 [ 859.292326] [<0000000078e6ec93>] ? fsnotify_mark_destroy_list+0x104/0x390 [ 859.292334] [<000000004f78e073>] synchronize_srcu+0x1f/0x40 [ 859.292342] [<00000000de055a11>] fsnotify_mark_destroy_list+0x110/0x390 [ 859.292359] [<000000008842167c>] ? free_object+0x2b0/0x2b0 [ 859.292367] [<00000000c095ed99>] ? fsnotify_init_mark+0xa0/0xa0 [ 859.292375] [<0000000042f242e4>] ? check_preemption_disabled+0x3c/0x200 [ 859.292390] [<00000000fef6e7ae>] fsnotify_mark_destroy_workfn+0xe/0x10 [ 859.292398] [<0000000019d39bc9>] process_one_work+0x88b/0x1600 [ 859.292405] [<00000000d89c42a0>] ? process_one_work+0x7ce/0x1600 [ 859.292423] [<000000006073d15d>] ? pwq_dec_nr_in_flight+0x2e0/0x2e0 [ 859.292439] [<0000000015a333c1>] ? _raw_spin_unlock_irq+0x28/0x60 [ 859.292460] [<0000000032898dd2>] worker_thread+0x5df/0x11d0 [ 859.292468] [<000000002dce7b19>] ? process_one_work+0x1600/0x1600 [ 859.292476] [<00000000a38b1256>] kthread+0x278/0x310 [ 859.292503] [<00000000480adeaf>] ? trace_hardirqs_on+0xd/0x10 [ 859.292516] [<0000000000e88ee8>] ? kthread_park+0xa0/0xa0 [ 859.292524] [<000000005c7d4a14>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 859.292538] [<0000000081ae786c>] ? finish_task_switch+0x42a/0x660 [ 859.292546] [<000000008fcee105>] ? finish_task_switch+0x1b7/0x660 [ 859.292554] [<0000000052676fad>] ? __switch_to_asm+0x41/0x70 [ 859.292561] [<000000004b31b59b>] ? __switch_to_asm+0x35/0x70 [ 859.292571] [<0000000052676fad>] ? __switch_to_asm+0x41/0x70 [ 859.292584] [<0000000000e88ee8>] ? kthread_park+0xa0/0xa0 [ 859.292592] [<0000000000e88ee8>] ? kthread_park+0xa0/0xa0 [ 859.292604] [<0000000054ecc1d3>] ret_from_fork+0x5c/0x70 [ 859.292608] [ 859.292608] Showing all locks held in the system: [ 859.292614] 2 locks held by khungtaskd/24: [ 859.292631] #0: (rcu_read_lock){......}, at: [<00000000a92af8ce>] watchdog+0x14b/0xaf0 [ 859.292646] #1: (tasklist_lock){.+.+..}, at: [<00000000be809c6a>] debug_show_all_locks+0x7f/0x21f [ 859.292654] 1 lock held by rsyslogd/1914: [ 859.292669] #0: (&f->f_pos_lock){+.+.+.}, at: [<00000000e79e19cb>] __fdget_pos+0xa8/0xd0 [ 859.292673] 2 locks held by getty/2042: [ 859.292686] #0: (&tty->ldisc_sem){++++++}, at: [<000000003e318ebb>] ldsem_down_read+0x33/0x40 [ 859.292702] #1: (&ldata->atomic_read_lock){+.+...}, at: [<0000000058c9d78e>] n_tty_read+0x1fe/0x1820 [ 859.292707] 2 locks held by kworker/u4:4/2137: [ 859.292725] #0: ("events_unbound"){.+.+.+}, at: [<00000000e3c91426>] process_one_work+0x790/0x1600 [ 859.292748] #1: ((reaper_work).work){+.+...}, at: [<00000000d89c42a0>] process_one_work+0x7ce/0x1600 [ 859.292753] 2 locks held by udevd/22768: [ 859.292766] #0: (&mm->mmap_sem){++++++}, at: [<00000000ba053311>] vm_mmap_pgoff+0x13d/0x1c0 [ 859.292781] #1: (&anon_vma->rwsem){++++..}, at: [<00000000d119a523>] validate_mm+0xdb/0x5a0 [ 859.292785] 4 locks held by udevd/25397: [ 859.292801] #0: (&dup_mmap_sem){.+.+.+}, at: [<00000000b18bad1e>] copy_process.part.0+0x38ca/0x63f0 [ 859.292815] #1: (&mm->mmap_sem){++++++}, at: [<000000006f0bc837>] copy_process.part.0+0x38e5/0x63f0 [ 859.292838] #2: (&mm->mmap_sem/1){+.+.+.}, at: [<00000000dc903b6b>] copy_process.part.0+0x391e/0x63f0 [ 859.292851] #3: (&anon_vma->rwsem){++++..}, at: [<0000000044add0fb>] anon_vma_clone+0x143/0x4a0 [ 859.292861] 2 locks held by udevd/25847: [ 859.292874] #0: (&sig->cred_guard_mutex){+.+.+.}, at: [<0000000002bede24>] prepare_bprm_creds+0x55/0x120 [ 859.292891] #1: (&anon_vma->rwsem){++++..}, at: [<0000000046b013ed>] __put_anon_vma+0x1d8/0x2c0 [ 859.292893] [ 859.292895] ============================================= [ 859.292895] [ 859.292903] NMI backtrace for cpu 0 [ 859.292936] CPU: 0 PID: 24 Comm: khungtaskd Not tainted 4.9.185+ #7 [ 859.292947] ffff8801d98d7cc8 ffffffff81b57f51 0000000000000000 0000000000000000 [ 859.292958] 0000000000000000 ffffffff81099a01 dffffc0000000000 ffff8801d98d7d00 [ 859.292967] ffffffff81b631ec 0000000000000000 0000000000000000 0000000000000000 [ 859.292969] Call Trace: [ 859.292978] [<000000000a27d38b>] dump_stack+0xc1/0x120 [ 859.292988] [<000000007b7d3e3a>] ? irq_force_complete_move+0x2e1/0x300 [ 859.293004] [<000000006eef93d6>] nmi_cpu_backtrace.cold+0x47/0x87 [ 859.293013] [<000000003bb2e5aa>] ? irq_force_complete_move+0x300/0x300 [ 859.293033] [<0000000013f683eb>] nmi_trigger_cpumask_backtrace+0x124/0x155 [ 859.293045] [<000000008404ac82>] arch_trigger_cpumask_backtrace+0x14/0x20 [ 859.293066] [<00000000d87049a8>] watchdog+0x670/0xaf0 [ 859.293074] [<00000000a92af8ce>] ? watchdog+0x14b/0xaf0 [ 859.293098] [<000000006fed4864>] ? trace_hardirqs_on_caller+0x385/0x5a0 [ 859.293122] [<000000002fac8649>] ? hungtask_pm_notify+0x60/0x60 [ 859.293129] [<00000000a38b1256>] kthread+0x278/0x310 [ 859.293137] [<0000000000e88ee8>] ? kthread_park+0xa0/0xa0 [ 859.293149] [<000000005c7d4a14>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 859.293160] [<00000000df99cc18>] ? _raw_spin_unlock_irq+0x39/0x60 [ 859.293174] [<00000000ce6da97b>] ? finish_task_switch+0x1e5/0x660 [ 859.293186] [<000000008fcee105>] ? finish_task_switch+0x1b7/0x660 [ 859.293193] [<0000000052676fad>] ? __switch_to_asm+0x41/0x70 [ 859.293200] [<000000004b31b59b>] ? __switch_to_asm+0x35/0x70 [ 859.293207] [<0000000052676fad>] ? __switch_to_asm+0x41/0x70 [ 859.293215] [<0000000000e88ee8>] ? kthread_park+0xa0/0xa0 [ 859.293222] [<0000000000e88ee8>] ? kthread_park+0xa0/0xa0 [ 859.293230] [<0000000054ecc1d3>] ret_from_fork+0x5c/0x70 [ 859.293236] Sending NMI from CPU 0 to CPUs 1: [ 859.293678] NMI backtrace for cpu 1 [ 859.293687] CPU: 1 PID: 25856 Comm: syz-executor.2 Not tainted 4.9.185+ #7 [ 859.293690] task: 000000007d166fd6 task.stack: 00000000641a8ff6 [ 859.293694] RIP: 0010:[] c [<0000000083afb952>] vm_normal_page+0x87/0x300 [ 859.293697] RSP: 0018:ffff8801a93ef620 EFLAGS: 00000a02 [ 859.293700] RAX: 1ffff1003527decb RBX: dffffc0000000000 RCX: ffff8801a93ef900 [ 859.293703] RDX: 0000000000000000 RSI: ffffffff8149faac RDI: ffff8801a93ef658 [ 859.293706] RBP: ffff8801a93ef6c0 R08: ffff8801a93ef920 R09: 0000000000000ed9 [ 859.293710] R10: ffff8801d68788b0 R11: 0000000000000001 R12: 1ffff1003527dec7 [ 859.293713] R13: 00007f86984dd000 R14: ffff8801a93ef698 R15: dffffc0000000000 [ 859.293717] FS: 00007f8696a9a700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000 [ 859.293719] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 859.293723] CR2: 00007fff6f5f4f58 CR3: 00000001ac5f1000 CR4: 00000000001606b0 [ 859.293726] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 859.293729] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 859.293731] Stack: [ 859.293735] 00007f86984dd000c ffff8801d67db960c 80000001b5faf007c 0000000041b58ab3c [ 859.293738] ffffffff82e3e6adc ffffffff8149fa30c 0000000000000000c 80000001b5fb0007c [ 859.293742] ffff8801a93ef688c 0000000000000001c 0000000000000000c ffff8800000004d8c [ 859.293744] Call Trace: [ 859.293747] [<00000000c7889aa5>] ? __pte_alloc_kernel+0x1c0/0x1c0 [ 859.293750] [<00000000450bfe49>] ? __tlb_remove_page_size+0x1a8/0x500 [ 859.293753] [<00000000fc083db2>] unmap_page_range+0x9d4/0x1690 [ 859.293756] [<00000000a316314c>] ? do_wp_page+0x20a0/0x20a0 [ 859.293758] [<000000003bd50b33>] ? uprobe_munmap+0x94/0x210 [ 859.293761] [<000000001a07b142>] unmap_single_vma+0x124/0x180 [ 859.293764] [<00000000138abba3>] unmap_vmas+0x48/0xa0 [ 859.293767] [<0000000043ef3b80>] exit_mmap+0x1e3/0x3b0 [ 859.293770] [<0000000077a4bddd>] ? SyS_munmap+0xb0/0xb0 [ 859.293772] [<00000000bef5c36e>] ? exit_aio+0x267/0x350 [ 859.293775] [<0000000030ae4246>] ? __might_sleep+0x95/0x1a0 [ 859.293778] [<00000000f519c543>] mmput+0xd5/0x370 [ 859.293781] [<00000000569c1ecf>] do_exit+0x6ca/0x2aa0 [ 859.293783] [<00000000155c14f0>] ? wake_up_q+0x95/0xf0 [ 859.293786] [<00000000fb3ff2b9>] ? drop_futex_key_refs.isra.0+0x1/0xd0 [ 859.293789] [<00000000a55a4258>] ? release_task+0x14a0/0x14a0 [ 859.293792] [<000000005c7d4a14>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 859.293796] [<0000000042f242e4>] ? check_preemption_disabled+0x3c/0x200 [ 859.293799] [<0000000042f242e4>] ? check_preemption_disabled+0x3c/0x200 [ 859.293801] [<00000000bdd7fb98>] do_group_exit+0x111/0x300 [ 859.293804] [<00000000ba59b1a8>] get_signal+0x377/0x1cb0 [ 859.293807] [<00000000edc411a3>] ? do_futex+0x161/0x1a70 [ 859.293810] [<00000000679802b3>] do_signal+0x9c/0x1920 [ 859.293813] [<00000000cdeb1634>] ? trace_hardirqs_on+0x10/0x10 [ 859.293816] [<0000000042f242e4>] ? check_preemption_disabled+0x3c/0x200 [ 859.293818] [<00000000279b6f93>] ? __fget+0x208/0x370 [ 859.293821] [<00000000dceb5bb4>] ? setup_sigcontext+0x7d0/0x7d0 [ 859.293824] [<000000005c7d4a14>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 859.293827] [<0000000084fa5872>] ? SyS_futex+0x25f/0x360 [ 859.293830] [<000000007f8a87ff>] ? do_futex+0x1a70/0x1a70 [ 859.293833] [<00000000b827e16b>] ? exit_to_usermode_loop+0xcc/0x160 [ 859.293836] [<00000000606fe252>] exit_to_usermode_loop+0x11c/0x160 [ 859.293839] [<00000000337fb8c4>] do_syscall_64+0x3ab/0x5c0 [ 859.293842] [<0000000075a27318>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 859.293852] Code: cf1 cc7 c40 c04 c00 cf3 cf3 cf3 c65 c48 c8b c04 c25 c28 c00 c00 c00 c48 c89 c45 cd0 c31 cc0 c48 c89 c55 c98 ce8 ce4 c12 ce8 cff c48 c8d c7d c98 c48 c89 cf8 c48 cc1 ce8 c03 c<80> c3c c18 c00 c0f c85 c30 c02 c00 c00 c4d c8b c6e cc0 c4c c89 cef c48 c89 cf8 c0f c [ 859.294250] Kernel panic - not syncing: hung_task: blocked tasks [ 859.294257] CPU: 0 PID: 24 Comm: khungtaskd Not tainted 4.9.185+ #7 [ 859.294269] ffff8801d98d7c60 ffffffff81b57f51 ffff8801cfeeaf00 ffffffff82a7ac60 [ 859.294279] 00000000ffffffff 0000000000000000 dffffc0000000000 ffff8801d98d7d40 [ 859.294289] ffffffff813fd56a 0000000041b58ab3 ffffffff82e3147a ffffffff813fd391 [ 859.294291] Call Trace: [ 859.294300] [<000000000a27d38b>] dump_stack+0xc1/0x120 [ 859.294307] [<0000000054aa669d>] panic+0x1d9/0x3bd [ 859.294315] [<00000000fa1b861d>] ? add_taint.cold+0x16/0x16 [ 859.294322] [<000000003d4ea366>] ? find_next_bit+0x44/0x50 [ 859.294330] [<0000000069846924>] ? printk_nmi_flush+0xae/0xd0 [ 859.294339] [<000000003bb2e5aa>] ? irq_force_complete_move+0x300/0x300 [ 859.294347] [<00000000b3291e83>] ? nmi_trigger_cpumask_backtrace+0xfc/0x155 [ 859.294355] [<00000000b92e9b21>] watchdog+0x681/0xaf0 [ 859.294362] [<00000000a92af8ce>] ? watchdog+0x14b/0xaf0 [ 859.294369] [<000000006fed4864>] ? trace_hardirqs_on_caller+0x385/0x5a0 [ 859.294377] [<000000002fac8649>] ? hungtask_pm_notify+0x60/0x60 [ 859.294391] [<00000000a38b1256>] kthread+0x278/0x310 [ 859.294399] [<0000000000e88ee8>] ? kthread_park+0xa0/0xa0 [ 859.294406] [<000000005c7d4a14>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 859.294414] [<00000000df99cc18>] ? _raw_spin_unlock_irq+0x39/0x60 [ 859.294422] [<00000000ce6da97b>] ? finish_task_switch+0x1e5/0x660 [ 859.294430] [<000000008fcee105>] ? finish_task_switch+0x1b7/0x660 [ 859.294437] [<0000000052676fad>] ? __switch_to_asm+0x41/0x70 [ 859.294444] [<000000004b31b59b>] ? __switch_to_asm+0x35/0x70 [ 859.294450] [<0000000052676fad>] ? __switch_to_asm+0x41/0x70 [ 859.294457] [<0000000000e88ee8>] ? kthread_park+0xa0/0xa0 [ 859.294465] [<0000000000e88ee8>] ? kthread_park+0xa0/0xa0 [ 859.294472] [<0000000054ecc1d3>] ret_from_fork+0x5c/0x70 [ 859.294878] Kernel Offset: disabled [ 861.639220] Rebooting in 86400 seconds..