xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 7 printk messages dropped ** [ 795.326988] binder: 14114:14118 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 795.383747] binder: 14128:14135 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 1 printk messages dropped ** [ 795.423050] binder: 14136:14140 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 9 printk messages dropped ** [ 795.500180] binder: 14163:14167 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 1 printk messages dropped ** [ 795.525776] binder: 14166:14168 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 795.591784] binder: 14178:14187 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 795.658188] binder: 14200:14205 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 795.722150] binder: 14213:14216 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 795.788804] binder: 14233:14235 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 795.836707] binder: 14248:14253 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 3 printk messages dropped ** [ 795.873188] binder: 14257:14260 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 795.931020] binder: 14269:14274 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 795.971036] binder: 14273:14286 transaction failed 29189/-22, size 0-0 line 3119 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 796.031820] binder: 14298:14303 transaction failed 29189/-22, size 0-0 line 3119 14:19:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:44 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:44 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 796.076065] binder: 14307:14311 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 796.100136] binder: 14318:14320 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 4 printk messages dropped ** [ 796.155058] binder: 14330:14335 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 796.222853] binder: 14347:14351 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 796.268388] binder: 14357:14358 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 9 printk messages dropped ** [ 796.347952] binder: 14377:14380 transaction failed 29189/-22, size 0-0 line 3119 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 1 printk messages dropped ** [ 796.360569] binder: 14383:14386 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 796.437904] binder: 14398:14404 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 796.508297] binder: 14418:14423 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 796.579295] binder: 14436:14444 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 7 printk messages dropped ** [ 796.644224] binder: 14452:14454 transaction failed 29189/-22, size 0-0 line 3119 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 796.697565] binder: 14470:14474 transaction failed 29189/-22, size 0-0 line 3119 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 796.749013] binder: 14482:14486 transaction failed 29189/-22, size 0-0 line 3119 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 796.822964] binder: 14496:14498 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 796.826504] binder: 14495:14499 transaction failed 29189/-22, size 0-0 line 3119 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 9 printk messages dropped ** [ 796.945502] binder: 14528:14530 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 3 printk messages dropped ** [ 796.992309] binder: 14534:14538 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:45 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 797.064633] binder: 14553:14560 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 797.141809] binder: 14570:14576 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 797.198856] binder: 14585:14587 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 797.211318] binder: 14590:14597 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 4 printk messages dropped ** [ 797.261322] binder: 14602:14607 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 797.340992] binder: 14619:14627 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 797.410592] binder: 14641:14646 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 797.468010] binder: 14656:14660 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 797.536148] binder: 14675:14680 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 797.560594] binder: 14674:14678 transaction failed 29189/-22, size 0-0 line 3119 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 7 printk messages dropped ** [ 797.658362] binder: 14701:14708 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 797.735028] binder: 14726:14728 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 797.735156] binder: 14726:14728 transaction failed 29189/-22, size 0-0 line 3119 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 797.788679] binder: 14720:14727 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 797.872214] binder: 14755:14761 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 797.927966] binder: 14771:14776 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 797.995020] binder: 14789:14796 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:46 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:46 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:46 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 798.054992] binder: 14807:14813 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 798.117342] binder: 14819:14830 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 798.117476] binder: 14819:14830 Release 1 refcount change on invalid ref 0 ret -22 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 798.117489] binder: 14819:14830 transaction failed 29189/-22, size 0-0 line 3119 [ 798.130989] binder: 14829:14832 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 2 printk messages dropped ** [ 798.167537] binder: 14837:14841 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 3 printk messages dropped ** [ 798.179819] binder: 14843:14846 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 798.234182] binder: 14852:14856 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 798.295966] binder: 14870:14873 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 1 printk messages dropped ** [ 798.351771] binder: 14880:14889 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 1 printk messages dropped ** [ 798.354620] binder: 14882:14890 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 7 printk messages dropped ** [ 798.406189] binder: 14901:14903 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 798.450998] binder: 14913:14914 transaction failed 29189/-22, size 0-0 line 3119 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 9 printk messages dropped ** [ 798.578802] binder: 14938:14946 transaction failed 29189/-22, size 0-0 line 3119 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 798.635886] binder: 14957:14962 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 798.693480] binder: 14975:14978 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 798.732585] binder: 14984:14989 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 1 printk messages dropped ** [ 798.800875] binder: 14994:15003 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 798.832679] binder: 15010:15013 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:47 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:47 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 798.878323] binder: 15025:15027 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 798.936241] binder: 15039:15043 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 798.979539] binder: 15054:15056 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 799.050740] binder: 15063:15072 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 799.131187] binder: 15086:15094 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 799.204089] binder: 15102:15108 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 3 printk messages dropped ** [ 799.235088] binder: 15117:15121 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 3 printk messages dropped ** [ 799.252778] binder: 15122:15128 transaction failed 29189/-22, size 0-0 line 3119 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 799.355907] binder: 15138:15147 transaction failed 29189/-22, size 0-0 line 3119 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 799.398889] binder: 15157:15164 transaction failed 29189/-22, size 0-0 line 3119 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 799.483976] binder: 15175:15180 transaction failed 29189/-22, size 0-0 line 3119 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 9 printk messages dropped ** [ 799.625353] binder: 15220:15223 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 5 printk messages dropped ** [ 799.685506] binder: 15231:15240 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 799.685630] binder: 15231:15240 transaction failed 29189/-22, size 0-0 line 3119 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 799.729713] binder: 15246:15247 transaction failed 29189/-22, size 0-0 line 3119 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 799.800684] binder: 15258:15264 transaction failed 29189/-22, size 0-0 line 3119 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:48 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 9 printk messages dropped ** [ 799.930244] binder: 15297:15300 transaction failed 29189/-22, size 0-0 line 3119 14:19:48 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 799.981633] binder: 15306:15312 transaction failed 29189/-22, size 0-0 line 3119 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 800.003058] binder: 15316:15318 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 3 printk messages dropped ** [ 800.064175] binder: 15321:15331 transaction failed 29189/-22, size 0-0 line 3119 ** 5 printk messages dropped ** [ 800.093987] binder: 15342:15343 transaction failed 29189/-22, size 0-0 line 3119 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 800.183676] binder: 15351:15362 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 800.200851] binder: 15356:15361 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 800.200864] binder: 15356:15361 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 3 printk messages dropped ** [ 800.223809] binder: 15373:15376 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 800.308795] binder: 15386:15393 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 1 printk messages dropped ** [ 800.331149] binder: 15391:15398 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 800.408794] binder: 15411:15419 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 7 printk messages dropped ** [ 800.472739] binder: 15427:15440 transaction failed 29189/-22, size 0-0 line 3119 [ 800.519214] binder: 15445:15449 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 4 printk messages dropped ** [ 800.521215] binder: 15446:15450 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 800.574147] binder: 15460:15464 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 800.628136] binder: 15471:15474 transaction failed 29189/-22, size 0-0 line 3119 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 800.663811] binder: 15489:15492 Acquire 1 refcount change on invalid ref 0 ret -22 ** 4 printk messages dropped ** [ 800.683844] binder: 15487:15491 transaction failed 29189/-22, size 0-0 line 3119 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 800.748596] binder: 15504:15509 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 800.802350] binder: 15521:15524 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:49 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 4 printk messages dropped ** [ 800.812757] binder: 15522:15525 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:49 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 800.880372] binder: 15538:15543 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 1 printk messages dropped ** [ 800.918405] binder: 15552:15554 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 7 printk messages dropped ** [ 801.002805] binder: 15571:15574 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 3 printk messages dropped ** [ 801.045835] binder: 15577:15583 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 801.087956] binder: 15596:15600 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 801.125068] binder: 15608:15610 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 9 printk messages dropped ** [ 801.239287] binder: 15630:15639 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 801.305900] binder: 15646:15650 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 3 printk messages dropped ** [ 801.344094] binder: 15660:15661 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 801.402498] binder: 15674:15680 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 801.477610] binder: 15688:15695 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 801.544577] binder: 15703:15715 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 801.594922] binder: 15722:15730 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 801.677453] binder: 15737:15742 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 801.735389] binder: 15756:15765 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 801.787169] binder: 15772:15778 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:50 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:50 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 7 printk messages dropped ** [ 801.894592] binder: 15797:15803 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 9 printk messages dropped ** [ 801.970399] binder: 15817:15825 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 7 printk messages dropped ** [ 802.085481] binder: 15847:15851 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 3 printk messages dropped ** [ 802.129573] binder: 15853:15859 transaction failed 29189/-22, size 0-0 line 3119 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 802.150821] binder: 15862:15867 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 802.199059] binder: 15874:15880 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 5 printk messages dropped ** [ 802.290412] binder: 15894:15900 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 802.310300] binder: 15904:15905 Acquire 1 refcount change on invalid ref 0 ret -22 ** 4 printk messages dropped ** [ 802.352131] binder: 15913:15918 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 802.411348] binder: 15927:15932 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 3 printk messages dropped ** [ 802.442667] binder: 15931:15937 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 1 printk messages dropped ** [ 802.459426] binder: 15944:15948 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 9 printk messages dropped ** [ 802.564463] binder: 15970:15976 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 802.622502] binder: 15986:15990 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 802.679581] binder: 16000:16008 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 802.742595] binder: 16017:16024 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:51 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:51 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:51 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 9 printk messages dropped ** [ 802.837842] binder: 16035:16044 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 802.904631] binder: 16056:16063 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 802.943196] binder: 16071:16074 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 802.998092] binder: 16084:16087 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 803.081994] binder: 16109:16112 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 803.145940] binder: 16125:16134 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 803.207685] binder: 16139:16142 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 803.263700] binder: 16156:16164 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 5 printk messages dropped ** [ 803.320108] binder: 16175:16180 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 803.404910] binder: 16197:16199 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 803.465773] binder: 16209:16215 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 803.465918] binder: 16209:16215 transaction failed 29189/-22, size 0-0 line 3119 ** 5 printk messages dropped ** [ 803.527300] binder: 16226:16231 transaction failed 29189/-22, size 0-0 line 3119 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 803.564260] binder: 16243:16245 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 11 printk messages dropped ** [ 803.658519] binder: 16257:16264 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 803.721618] binder: 16272:16278 transaction failed 29189/-22, size 0-0 line 3119 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 7 printk messages dropped ** [ 803.845886] binder: 16308:16317 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 803.846006] binder: 16308:16317 Release 1 refcount change on invalid ref 0 ret -22 14:19:52 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 4 printk messages dropped ** [ 803.918403] binder: 16324:16334 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 803.988426] binder: 16346:16350 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 804.044058] binder: 16362:16364 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 9 printk messages dropped ** [ 804.116741] binder: 16378:16387 transaction failed 29189/-22, size 0-0 line 3119 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 804.177843] binder: 16396:16404 transaction failed 29189/-22, size 0-0 line 3119 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 804.236700] binder: 16411:16412 transaction failed 29189/-22, size 0-0 line 3119 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 804.288833] binder: 16426:16432 transaction failed 29189/-22, size 0-0 line 3119 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 804.337791] binder: 16438:16443 transaction failed 29189/-22, size 0-0 line 3119 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 804.418368] binder: 16461:16466 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 7 printk messages dropped ** [ 804.512403] binder: 16485:16493 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 7 printk messages dropped ** [ 804.570527] binder: 16502:16507 transaction failed 29189/-22, size 0-0 line 3119 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 3 printk messages dropped ** [ 804.632594] binder: 16522:16525 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 804.676206] binder: 16534:16539 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:53 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 804.732783] binder: 16550:16554 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:53 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 804.799967] binder: 16564:16574 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 804.876405] binder: 16582:16591 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 7 printk messages dropped ** [ 804.963708] binder: 16603:16613 transaction failed 29189/-22, size 0-0 line 3119 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 804.996501] binder: 16607:16615 Acquire 1 refcount change on invalid ref 0 ret -22 ** 4 printk messages dropped ** [ 805.042620] binder: 16626:16632 transaction failed 29189/-22, size 0-0 line 3119 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 805.056530] binder: 16628:16637 Acquire 1 refcount change on invalid ref 0 ret -22 ** 4 printk messages dropped ** [ 805.105756] binder: 16639:16645 transaction failed 29189/-22, size 0-0 line 3119 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 1 printk messages dropped ** [ 805.141371] binder: 16653:16656 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 805.141486] binder: 16653:16656 Release 1 refcount change on invalid ref 0 ret -22 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 2 printk messages dropped ** [ 805.141614] binder: 16647:16652 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 7 printk messages dropped ** [ 805.269607] binder: 16686:16689 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 805.269729] binder: 16686:16689 Release 1 refcount change on invalid ref 0 ret -22 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 4 printk messages dropped ** [ 805.306180] binder: 16696:16702 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 805.306312] binder: 16696:16702 transaction failed 29189/-22, size 0-0 line 3119 ** 5 printk messages dropped ** [ 805.398190] binder: 16717:16725 transaction failed 29189/-22, size 0-0 line 3119 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 805.452980] binder: 16723:16730 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 3 printk messages dropped ** [ 805.526797] binder: 16739:16748 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 7 printk messages dropped ** [ 805.589716] binder: 16754:16761 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 805.659657] binder: 16776:16779 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:54 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:54 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:54 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 9 printk messages dropped ** [ 805.746257] binder: 16793:16800 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 805.817708] binder: 16816:16820 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 1 printk messages dropped ** [ 805.857951] binder: 16825:16831 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 11 printk messages dropped ** [ 805.984732] binder: 16850:16859 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 3 printk messages dropped ** [ 806.038254] binder: 16868:16874 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 1 printk messages dropped ** [ 806.038574] binder: 16870:16873 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 806.108599] binder: 16884:16891 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 806.165365] binder: 16904:16909 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 806.232324] binder: 16918:16927 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 806.307908] binder: 16936:16943 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 806.356648] binder: 16952:16960 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 806.405308] binder: 16965:16971 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 806.468902] binder: 16982:16987 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 806.529539] binder: 16994:17003 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 806.589147] binder: 17011:17017 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:55 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:55 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:55 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 806.651883] binder: 17024:17029 transaction failed 29189/-22, size 0-0 line 3119 14:19:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 806.720319] binder: 17044:17050 transaction failed 29189/-22, size 0-0 line 3119 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 806.798905] binder: 17059:17069 transaction failed 29189/-22, size 0-0 line 3119 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 806.817671] binder: 17072:17075 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 4 printk messages dropped ** [ 806.875744] binder: 17080:17088 transaction failed 29189/-22, size 0-0 line 3119 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 806.934724] binder: 17098:17104 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 806.994432] binder: 17116:17121 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 806.994560] binder: 17116:17121 Release 1 refcount change on invalid ref 0 ret -22 [ 806.994573] binder: 17116:17121 transaction failed 29189/-22, size 0-0 line 3119 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 807.031890] binder: 17128:17131 Acquire 1 refcount change on invalid ref 0 ret -22 [ 807.031904] binder: 17128:17131 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 807.032029] binder: 17128:17131 Release 1 refcount change on invalid ref 0 ret -22 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 807.032043] binder: 17128:17131 transaction failed 29189/-22, size 0-0 line 3119 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 807.042260] binder: 17124:17129 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 4 printk messages dropped ** [ 807.093332] binder: 17139:17147 transaction failed 29189/-22, size 0-0 line 3119 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 807.145648] binder: 17156:17160 transaction failed 29189/-22, size 0-0 line 3119 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 9 printk messages dropped ** [ 807.274322] binder: 17187:17189 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 7 printk messages dropped ** [ 807.340543] binder: 17207:17211 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 807.417587] binder: 17220:17226 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:56 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:56 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:56 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 807.494771] binder: 17237:17244 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 7 printk messages dropped ** [ 807.571280] binder: 17260:17267 transaction failed 29189/-22, size 0-0 line 3119 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 807.640542] binder: 17279:17286 transaction failed 29189/-22, size 0-0 line 3119 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 9 printk messages dropped ** [ 807.786489] binder: 17320:17325 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 807.837860] binder: 17334:17338 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 9 printk messages dropped ** [ 807.921590] binder: 17355:17359 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 807.983045] binder: 17370:17376 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 7 printk messages dropped ** [ 808.044448] binder: 17391:17393 transaction failed 29189/-22, size 0-0 line 3119 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 808.132615] binder: 17410:17414 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 808.156746] binder: 17419:17424 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 7 printk messages dropped ** [ 808.218843] binder: 17434:17442 transaction failed 29189/-22, size 0-0 line 3119 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 7 printk messages dropped ** [ 808.320703] binder: 17462:17466 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 5 printk messages dropped ** [ 808.379775] binder: 17476:17483 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:57 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 808.382834] binder: 17475:17480 transaction failed 29189/-22, size 0-0 line 3119 14:19:57 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:57 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 1 printk messages dropped ** [ 808.451179] binder: 17493:17499 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 9 printk messages dropped ** [ 808.520287] binder: 17509:17516 transaction failed 29189/-22, size 0-0 line 3119 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 1 printk messages dropped ** [ 808.551529] binder: 17522:17525 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 808.597852] binder: 17534:17539 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 808.656058] binder: 17544:17552 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 3 printk messages dropped ** [ 808.680653] binder: 17554:17558 transaction failed 29189/-22, size 0-0 line 3119 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 808.756675] binder: 17573:17581 transaction failed 29189/-22, size 0-0 line 3119 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 808.820825] binder: 17587:17593 transaction failed 29189/-22, size 0-0 line 3119 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 808.855701] binder: 17603:17608 transaction failed 29189/-22, size 0-0 line 3119 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 808.908684] binder: 17612:17619 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 808.969782] binder: 17629:17636 Acquire 1 refcount change on invalid ref 0 ret -22 ** 4 printk messages dropped ** [ 808.981680] binder: 17633:17638 transaction failed 29189/-22, size 0-0 line 3119 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 1 printk messages dropped ** [ 809.053908] binder: 17644:17657 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 809.107520] binder: 17665:17672 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 809.150749] binder: 17670:17678 Acquire 1 refcount change on invalid ref 0 ret -22 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 4 printk messages dropped ** [ 809.169892] binder: 17679:17687 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 3 printk messages dropped ** [ 809.202772] binder: 17690:17692 transaction failed 29189/-22, size 0-0 line 3119 14:19:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:58 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:58 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:58 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 7 printk messages dropped ** [ 809.292214] binder: 17717:17720 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 809.384696] binder: 17732:17742 transaction failed 29189/-22, size 0-0 line 3119 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 7 printk messages dropped ** [ 809.464014] binder: 17758:17761 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 809.530466] binder: 17772:17779 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 3 printk messages dropped ** [ 809.569391] binder: 17784:17787 transaction failed 29189/-22, size 0-0 line 3119 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 809.624096] binder: 17798:17802 transaction failed 29189/-22, size 0-0 line 3119 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 809.674806] binder: 17815:17818 transaction failed 29189/-22, size 0-0 line 3119 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 809.737452] binder: 17826:17834 transaction failed 29189/-22, size 0-0 line 3119 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 809.803866] binder: 17846:17851 transaction failed 29189/-22, size 0-0 line 3119 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 809.868589] binder: 17864:17870 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 809.909802] binder: 17875:17880 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 7 printk messages dropped ** [ 809.977068] binder: 17894:17898 transaction failed 29189/-22, size 0-0 line 3119 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 3 printk messages dropped ** [ 810.038273] binder: 17904:17915 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 810.094353] binder: 17922:17929 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 3 printk messages dropped ** [ 810.147179] binder: 17932:17936 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:19:59 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 1 printk messages dropped ** [ 810.148039] binder: 17941:17943 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:19:59 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:19:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:19:59 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 810.218239] binder: 17953:17955 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 810.263682] binder: 17967:17971 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 1 printk messages dropped ** [ 810.298132] binder: 17973:17978 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 810.298242] binder: 17973:17978 Release 1 refcount change on invalid ref 0 ret -22 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 4 printk messages dropped ** [ 810.347988] binder: 17989:17992 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 810.384098] binder: 17999:18002 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 810.438310] binder: 18013:18018 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 ** 1 printk messages dropped ** [ 810.501527] binder: 18025:18033 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 810.571317] binder: 18047:18052 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 810.574390] binder: 18040:18053 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 4 printk messages dropped ** [ 810.609016] binder: 18057:18061 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 810.665638] binder: 18065:18071 transaction failed 29189/-22, size 0-0 line 3119 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 810.748070] binder: 18086:18096 transaction failed 29189/-22, size 0-0 line 3119 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 11 printk messages dropped ** [ 810.864673] binder: 18127:18131 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 810.900837] binder: 18138:18144 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 810.966800] binder: 18151:18160 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:00 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 811.013296] binder: 18170:18173 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:00 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 811.077113] binder: 18185:18189 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 811.140320] binder: 18204:18207 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 811.198389] binder: 18217:18221 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 811.273498] binder: 18238:18243 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 811.308110] binder: 18248:18252 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 811.360221] binder: 18261:18265 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 811.422083] binder: 18276:18280 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 811.477821] binder: 18287:18294 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 811.477834] binder: 18287:18294 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 811.498830] binder: 18288:18296 transaction failed 29189/-22, size 0-0 line 3119 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 811.548331] binder: 18310:18314 transaction failed 29189/-22, size 0-0 line 3119 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 811.602798] binder: 18322:18325 transaction failed 29189/-22, size 0-0 line 3119 ** 3 printk messages dropped ** [ 811.664617] binder: 18338:18344 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 7 printk messages dropped ** [ 811.742586] binder: 18353:18362 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 811.811121] binder: 18376:18381 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:01 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 3 printk messages dropped ** [ 811.844540] binder: 18385:18389 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:01 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 811.882980] binder: 18390:18394 transaction failed 29189/-22, size 0-0 line 3119 14:20:01 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 811.926249] binder: 18410:18412 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:02 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:02 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ** 5 printk messages dropped ** [ 811.984978] binder: 18420:18429 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) ** 5 printk messages dropped ** [ 812.056218] binder: 18437:18445 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:02 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 812.083770] binder: 18442:18453 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) ** 5 printk messages dropped ** [ 812.126235] binder: 18461:18463 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:02 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:02 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 812.199089] binder: 18471:18479 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:02 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:02 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 812.267445] binder: 18494:18497 transaction failed 29189/-22, size 0-0 line 3119 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 812.342991] binder: 18511:18517 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:02 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:02 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 812.405039] binder: 18526:18534 transaction failed 29189/-22, size 0-0 line 3119 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ** 5 printk messages dropped ** [ 812.450059] binder: 18537:18540 transaction failed 29189/-22, size 0-0 line 3119 14:20:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:02 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:02 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) ** 5 printk messages dropped ** [ 812.527116] binder: 18555:18556 transaction failed 29189/-22, size 0-0 line 3119 ** 5 printk messages dropped ** [ 812.589835] binder: 18571:18576 transaction failed 29189/-22, size 0-0 line 3119 [ 812.590986] binder: 18573:18577 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.590998] binder: 18573:18577 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.644617] binder: 18585:18590 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.644631] binder: 18585:18590 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.650288] binder: 18584:18592 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.650300] binder: 18584:18592 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.650417] binder: 18584:18592 Release 1 refcount change on invalid ref 0 ret -22 [ 812.650430] binder: 18584:18592 transaction failed 29189/-22, size 0-0 line 3119 [ 812.702166] binder: 18600:18603 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.702178] binder: 18600:18603 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.704770] binder: 18602:18604 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.704782] binder: 18602:18604 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.705120] binder: 18602:18604 Release 1 refcount change on invalid ref 0 ret -22 [ 812.705134] binder: 18602:18604 transaction failed 29189/-22, size 0-0 line 3119 [ 812.739375] binder: 18611:18616 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.739388] binder: 18611:18616 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.780717] binder: 18624:18627 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.780729] binder: 18624:18627 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.785118] binder: 18615:18621 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.785131] binder: 18615:18621 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.785244] binder: 18615:18621 Release 1 refcount change on invalid ref 0 ret -22 [ 812.785258] binder: 18615:18621 transaction failed 29189/-22, size 0-0 line 3119 [ 812.841507] binder: 18634:18641 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.841520] binder: 18634:18641 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.841648] binder: 18634:18641 Release 1 refcount change on invalid ref 0 ret -22 [ 812.841662] binder: 18634:18641 transaction failed 29189/-22, size 0-0 line 3119 [ 812.868097] binder: 18637:18644 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.868110] binder: 18637:18644 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.901691] binder: 18648:18651 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.901704] binder: 18648:18651 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.902255] binder: 18648:18651 Release 1 refcount change on invalid ref 0 ret -22 [ 812.902268] binder: 18648:18651 transaction failed 29189/-22, size 0-0 line 3119 [ 812.943925] binder: 18655:18660 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.943938] binder: 18655:18660 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.978963] binder: 18673:18675 Acquire 1 refcount change on invalid ref 0 ret -22 [ 812.978976] binder: 18673:18675 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.000363] binder: 18667:18676 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.000376] binder: 18667:18676 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.003977] binder: 18667:18676 Release 1 refcount change on invalid ref 0 ret -22 [ 813.003990] binder: 18667:18676 transaction failed 29189/-22, size 0-0 line 3119 [ 813.041723] binder: 18688:18693 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.041737] binder: 18688:18693 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.041858] binder: 18688:18693 Release 1 refcount change on invalid ref 0 ret -22 [ 813.041870] binder: 18688:18693 transaction failed 29189/-22, size 0-0 line 3119 [ 813.044637] binder: 18682:18686 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.044651] binder: 18682:18686 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.087376] binder: 18697:18704 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.087388] binder: 18697:18704 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.087511] binder: 18697:18704 Release 1 refcount change on invalid ref 0 ret -22 [ 813.087524] binder: 18697:18704 transaction failed 29189/-22, size 0-0 line 3119 [ 813.112780] binder: 18701:18705 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.112793] binder: 18701:18705 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.126572] binder: 18708:18714 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.126584] binder: 18708:18714 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.126812] binder: 18708:18714 Release 1 refcount change on invalid ref 0 ret -22 [ 813.126825] binder: 18708:18714 transaction failed 29189/-22, size 0-0 line 3119 [ 813.199484] binder: 18724:18730 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.199504] binder: 18724:18730 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.206811] binder: 18724:18730 Release 1 refcount change on invalid ref 0 ret -22 [ 813.206827] binder: 18724:18730 transaction failed 29189/-22, size 0-0 line 3119 [ 813.208016] binder: 18726:18733 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.208029] binder: 18726:18733 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.257841] binder: 18743:18747 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.257854] binder: 18743:18747 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.258000] binder: 18743:18747 Release 1 refcount change on invalid ref 0 ret -22 [ 813.258014] binder: 18743:18747 transaction failed 29189/-22, size 0-0 line 3119 [ 813.261504] binder: 18746:18750 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.261516] binder: 18746:18750 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.310251] binder: 18756:18763 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.310264] binder: 18756:18763 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.311271] binder: 18756:18763 Release 1 refcount change on invalid ref 0 ret -22 [ 813.311283] binder: 18756:18763 transaction failed 29189/-22, size 0-0 line 3119 [ 813.327079] binder: 18755:18761 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.327092] binder: 18755:18761 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.372966] binder: 18771:18773 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.372978] binder: 18771:18773 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.377836] binder: 18770:18777 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.377848] binder: 18770:18777 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.377973] binder: 18770:18777 Release 1 refcount change on invalid ref 0 ret -22 [ 813.377998] binder: 18770:18777 transaction failed 29189/-22, size 0-0 line 3119 [ 813.431930] binder: 18783:18792 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.431944] binder: 18783:18792 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.436501] binder: 18788:18793 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.436514] binder: 18788:18793 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.437594] binder: 18788:18793 Release 1 refcount change on invalid ref 0 ret -22 [ 813.437607] binder: 18788:18793 transaction failed 29189/-22, size 0-0 line 3119 [ 813.489733] binder: 18800:18801 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.489746] binder: 18800:18801 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.495655] binder: 18802:18810 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.495667] binder: 18802:18810 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.495782] binder: 18802:18810 Release 1 refcount change on invalid ref 0 ret -22 [ 813.495796] binder: 18802:18810 transaction failed 29189/-22, size 0-0 line 3119 [ 813.545455] binder: 18816:18817 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.545468] binder: 18816:18817 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.582052] binder: 18820:18829 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.582066] binder: 18820:18829 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.583227] binder: 18820:18829 Release 1 refcount change on invalid ref 0 ret -22 [ 813.583241] binder: 18820:18829 transaction failed 29189/-22, size 0-0 line 3119 [ 813.640255] binder: 18827:18835 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.640269] binder: 18827:18835 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.649540] binder: 18842:18844 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.649553] binder: 18842:18844 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.668528] binder: 18842:18844 Release 1 refcount change on invalid ref 0 ret -22 [ 813.668542] binder: 18842:18844 transaction failed 29189/-22, size 0-0 line 3119 [ 813.691272] binder: 18850:18854 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.691286] binder: 18850:18854 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.707334] binder: 18855:18861 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.707345] binder: 18855:18861 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.707522] binder: 18855:18861 Release 1 refcount change on invalid ref 0 ret -22 [ 813.707535] binder: 18855:18861 transaction failed 29189/-22, size 0-0 line 3119 [ 813.737369] binder: 18862:18866 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.737381] binder: 18862:18866 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.758806] binder: 18869:18872 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.758818] binder: 18869:18872 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.759060] binder: 18869:18872 Release 1 refcount change on invalid ref 0 ret -22 [ 813.759074] binder: 18869:18872 transaction failed 29189/-22, size 0-0 line 3119 [ 813.793573] binder: 18878:18882 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.793586] binder: 18878:18882 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.827592] binder: 18886:18891 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.827604] binder: 18886:18891 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.827712] binder: 18886:18891 Release 1 refcount change on invalid ref 0 ret -22 [ 813.827724] binder: 18886:18891 transaction failed 29189/-22, size 0-0 line 3119 [ 813.834755] binder: 18890:18893 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.834768] binder: 18890:18893 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.901535] binder: 18901:18908 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.901548] binder: 18901:18908 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.901659] binder: 18901:18908 Release 1 refcount change on invalid ref 0 ret -22 [ 813.901672] binder: 18901:18908 transaction failed 29189/-22, size 0-0 line 3119 [ 813.915267] binder: 18904:18910 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.915280] binder: 18904:18910 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.956630] binder: 18915:18920 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.956644] binder: 18915:18920 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.956765] binder: 18915:18920 Release 1 refcount change on invalid ref 0 ret -22 [ 813.956781] binder: 18915:18920 transaction failed 29189/-22, size 0-0 line 3119 [ 813.975870] binder: 18921:18925 Acquire 1 refcount change on invalid ref 0 ret -22 [ 813.975888] binder: 18921:18925 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.035259] binder: 18930:18935 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.035272] binder: 18930:18935 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.035410] binder: 18930:18935 Release 1 refcount change on invalid ref 0 ret -22 [ 814.035424] binder: 18930:18935 transaction failed 29189/-22, size 0-0 line 3119 [ 814.053101] binder: 18936:18940 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.053113] binder: 18936:18940 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.091334] binder: 18948:18952 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.091347] binder: 18948:18952 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.091491] binder: 18948:18952 Release 1 refcount change on invalid ref 0 ret -22 [ 814.091504] binder: 18948:18952 transaction failed 29189/-22, size 0-0 line 3119 [ 814.123015] binder: 18955:18964 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.123030] binder: 18955:18964 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.162204] binder: 18963:18965 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.162217] binder: 18963:18965 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.162335] binder: 18963:18965 Release 1 refcount change on invalid ref 0 ret -22 [ 814.162349] binder: 18963:18965 transaction failed 29189/-22, size 0-0 line 3119 [ 814.200431] binder: 18976:18979 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.200444] binder: 18976:18979 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.321491] binder: 18991:18994 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.321505] binder: 18991:18994 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.321638] binder: 18991:18994 Release 1 refcount change on invalid ref 0 ret -22 [ 814.321651] binder: 18991:18994 transaction failed 29189/-22, size 0-0 line 3119 [ 814.333198] binder: 18989:18996 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.333212] binder: 18989:18996 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.372937] binder: 19005:19011 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.372950] binder: 19005:19011 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.373076] binder: 19005:19011 Release 1 refcount change on invalid ref 0 ret -22 [ 814.373090] binder: 19005:19011 transaction failed 29189/-22, size 0-0 line 3119 [ 814.421331] binder: 19016:19020 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.421344] binder: 19016:19020 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.439263] binder: 19017:19022 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.439276] binder: 19017:19022 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.439413] binder: 19017:19022 Release 1 refcount change on invalid ref 0 ret -22 [ 814.439426] binder: 19017:19022 transaction failed 29189/-22, size 0-0 line 3119 [ 814.474511] binder: 19028:19035 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.474527] binder: 19028:19035 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.494533] binder: 19037:19039 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.494546] binder: 19037:19039 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.494673] binder: 19037:19039 Release 1 refcount change on invalid ref 0 ret -22 [ 814.494688] binder: 19037:19039 transaction failed 29189/-22, size 0-0 line 3119 [ 814.518747] binder: 19041:19045 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.518761] binder: 19041:19045 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.554475] binder: 19050:19051 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.554489] binder: 19050:19051 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.583423] binder: 19054:19058 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.583435] binder: 19054:19058 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.583552] binder: 19054:19058 Release 1 refcount change on invalid ref 0 ret -22 [ 814.583565] binder: 19054:19058 transaction failed 29189/-22, size 0-0 line 3119 [ 814.584656] binder: 19055:19061 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.584668] binder: 19055:19061 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.625363] binder: 19067:19070 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.625377] binder: 19067:19070 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.653039] binder: 19071:19078 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.653054] binder: 19071:19078 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.654068] binder: 19071:19078 Release 1 refcount change on invalid ref 0 ret -22 [ 814.654081] binder: 19071:19078 transaction failed 29189/-22, size 0-0 line 3119 [ 814.700835] binder: 19081:19088 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.700849] binder: 19081:19088 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.730218] binder: 19086:19094 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.730233] binder: 19086:19094 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.730381] binder: 19086:19094 Release 1 refcount change on invalid ref 0 ret -22 [ 814.730396] binder: 19086:19094 transaction failed 29189/-22, size 0-0 line 3119 [ 814.766012] binder: 19100:19103 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.766026] binder: 19100:19103 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.766161] binder: 19100:19103 Release 1 refcount change on invalid ref 0 ret -22 [ 814.766175] binder: 19100:19103 transaction failed 29189/-22, size 0-0 line 3119 [ 814.773927] binder: 19098:19106 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.773941] binder: 19098:19106 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.819374] binder: 19114:19119 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.819386] binder: 19114:19119 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.826009] binder: 19114:19119 Release 1 refcount change on invalid ref 0 ret -22 [ 814.826024] binder: 19114:19119 transaction failed 29189/-22, size 0-0 line 3119 [ 814.848623] binder: 19115:19122 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.848636] binder: 19115:19122 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.881544] binder: 19130:19134 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.881558] binder: 19130:19134 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.881681] binder: 19130:19134 Release 1 refcount change on invalid ref 0 ret -22 [ 814.881694] binder: 19130:19134 transaction failed 29189/-22, size 0-0 line 3119 [ 814.916010] binder: 19135:19142 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.916023] binder: 19135:19142 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.946812] binder: 19139:19148 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.946825] binder: 19139:19148 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.947022] binder: 19139:19148 Release 1 refcount change on invalid ref 0 ret -22 [ 814.947035] binder: 19139:19148 transaction failed 29189/-22, size 0-0 line 3119 [ 814.990597] binder: 19152:19156 Acquire 1 refcount change on invalid ref 0 ret -22 [ 814.990610] binder: 19152:19156 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.042207] binder: 19164:19170 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.042220] binder: 19164:19170 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.042342] binder: 19164:19170 Release 1 refcount change on invalid ref 0 ret -22 [ 815.042355] binder: 19164:19170 transaction failed 29189/-22, size 0-0 line 3119 [ 815.047558] binder: 19166:19174 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.049959] binder: 19166:19174 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.096563] binder: 19180:19185 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.096576] binder: 19180:19185 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.103157] binder: 19179:19186 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.103171] binder: 19179:19186 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.103468] binder: 19179:19186 Release 1 refcount change on invalid ref 0 ret -22 [ 815.103482] binder: 19179:19186 transaction failed 29189/-22, size 0-0 line 3119 [ 815.159521] binder: 19192:19198 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.159535] binder: 19192:19198 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.163558] binder: 19196:19199 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.163569] binder: 19196:19199 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.163685] binder: 19196:19199 Release 1 refcount change on invalid ref 0 ret -22 [ 815.163699] binder: 19196:19199 transaction failed 29189/-22, size 0-0 line 3119 [ 815.221155] binder: 19208:19213 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.221169] binder: 19208:19213 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.221291] binder: 19208:19213 Release 1 refcount change on invalid ref 0 ret -22 [ 815.221304] binder: 19208:19213 transaction failed 29189/-22, size 0-0 line 3119 [ 815.232860] binder: 19212:19217 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.232873] binder: 19212:19217 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.288009] binder: 19226:19232 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.288021] binder: 19226:19232 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.288214] binder: 19226:19232 Release 1 refcount change on invalid ref 0 ret -22 [ 815.288226] binder: 19226:19232 transaction failed 29189/-22, size 0-0 line 3119 [ 815.294646] binder: 19229:19235 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.294659] binder: 19229:19235 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.349002] binder: 19238:19246 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.349015] binder: 19238:19246 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.349135] binder: 19238:19246 Release 1 refcount change on invalid ref 0 ret -22 [ 815.349148] binder: 19238:19246 transaction failed 29189/-22, size 0-0 line 3119 [ 815.350983] binder: 19241:19247 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.350995] binder: 19241:19247 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.402581] binder: 19253:19260 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.402594] binder: 19253:19260 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.405804] binder: 19257:19261 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.405818] binder: 19257:19261 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.405929] binder: 19257:19261 Release 1 refcount change on invalid ref 0 ret -22 [ 815.405943] binder: 19257:19261 transaction failed 29189/-22, size 0-0 line 3119 [ 815.464951] binder: 19270:19276 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.464966] binder: 19270:19276 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.483439] binder: 19274:19278 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.483459] binder: 19274:19278 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.506693] binder: 19274:19278 Release 1 refcount change on invalid ref 0 ret -22 [ 815.506712] binder: 19274:19278 transaction failed 29189/-22, size 0-0 line 3119 [ 815.517687] binder: 19281:19282 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.517701] binder: 19281:19282 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.574989] binder: 19293:19296 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.575003] binder: 19293:19296 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.575150] binder: 19293:19296 Release 1 refcount change on invalid ref 0 ret -22 [ 815.575165] binder: 19293:19296 transaction failed 29189/-22, size 0-0 line 3119 [ 815.592999] binder: 19294:19301 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.593013] binder: 19294:19301 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.639652] binder: 19308:19316 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.639664] binder: 19308:19316 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.639791] binder: 19308:19316 Release 1 refcount change on invalid ref 0 ret -22 [ 815.639803] binder: 19308:19316 transaction failed 29189/-22, size 0-0 line 3119 [ 815.657491] binder: 19312:19320 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.657502] binder: 19312:19320 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.700231] binder: 19321:19323 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.700243] binder: 19321:19323 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.700365] binder: 19321:19323 Release 1 refcount change on invalid ref 0 ret -22 [ 815.700387] binder: 19321:19323 transaction failed 29189/-22, size 0-0 line 3119 [ 815.722496] binder: 19327:19334 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.722508] binder: 19327:19334 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.763997] binder: 19337:19342 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.764011] binder: 19337:19342 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.765075] binder: 19337:19342 Release 1 refcount change on invalid ref 0 ret -22 [ 815.765090] binder: 19337:19342 transaction failed 29189/-22, size 0-0 line 3119 [ 815.783981] binder: 19345:19349 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.783994] binder: 19345:19349 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.801075] binder: 19352:19355 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.801088] binder: 19352:19355 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.813219] binder: 19352:19355 Release 1 refcount change on invalid ref 0 ret -22 [ 815.813233] binder: 19352:19355 transaction failed 29189/-22, size 0-0 line 3119 [ 815.852693] binder: 19359:19368 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.852706] binder: 19359:19368 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.859853] binder: 19366:19370 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.859866] binder: 19366:19370 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.860000] binder: 19366:19370 Release 1 refcount change on invalid ref 0 ret -22 [ 815.860013] binder: 19366:19370 transaction failed 29189/-22, size 0-0 line 3119 [ 815.899128] binder: 19371:19381 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.899141] binder: 19371:19381 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.935580] binder: 19376:19384 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.936271] binder: 19376:19384 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.936597] binder: 19376:19384 Release 1 refcount change on invalid ref 0 ret -22 [ 815.936611] binder: 19376:19384 transaction failed 29189/-22, size 0-0 line 3119 [ 815.971004] binder: 19390:19399 Acquire 1 refcount change on invalid ref 0 ret -22 [ 815.971017] binder: 19390:19399 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.003551] binder: 19396:19401 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.003565] binder: 19396:19401 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.003686] binder: 19396:19401 Release 1 refcount change on invalid ref 0 ret -22 [ 816.003699] binder: 19396:19401 transaction failed 29189/-22, size 0-0 line 3119 [ 816.038582] binder: 19407:19411 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.038596] binder: 19407:19411 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.067952] binder: 19413:19418 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.067966] binder: 19413:19418 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.068089] binder: 19413:19418 Release 1 refcount change on invalid ref 0 ret -22 [ 816.068102] binder: 19413:19418 transaction failed 29189/-22, size 0-0 line 3119 [ 816.097730] binder: 19423:19429 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.097742] binder: 19423:19429 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.115260] binder: 19425:19433 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.115274] binder: 19425:19433 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.115408] binder: 19425:19433 Release 1 refcount change on invalid ref 0 ret -22 [ 816.115421] binder: 19425:19433 transaction failed 29189/-22, size 0-0 line 3119 [ 816.178081] binder: 19439:19448 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.178095] binder: 19439:19448 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.190539] binder: 19446:19453 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.190552] binder: 19446:19453 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.191205] binder: 19446:19453 Release 1 refcount change on invalid ref 0 ret -22 [ 816.191219] binder: 19446:19453 transaction failed 29189/-22, size 0-0 line 3119 [ 816.241448] binder: 19459:19467 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.241462] binder: 19459:19467 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.275741] binder: 19461:19471 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.275755] binder: 19461:19471 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.279342] binder: 19461:19471 Release 1 refcount change on invalid ref 0 ret -22 [ 816.279355] binder: 19461:19471 transaction failed 29189/-22, size 0-0 line 3119 [ 816.304223] binder: 19470:19477 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.304236] binder: 19470:19477 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.331990] binder: 19479:19487 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.332004] binder: 19479:19487 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.332114] binder: 19479:19487 Release 1 refcount change on invalid ref 0 ret -22 [ 816.332127] binder: 19479:19487 transaction failed 29189/-22, size 0-0 line 3119 [ 816.349893] binder: 19488:19493 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.350920] binder: 19488:19493 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.363381] binder: 19494:19495 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.363392] binder: 19494:19495 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.363480] binder: 19494:19495 Release 1 refcount change on invalid ref 0 ret -22 [ 816.363498] binder: 19494:19495 transaction failed 29189/-22, size 0-0 line 3119 [ 816.428087] binder: 19504:19512 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.428100] binder: 19504:19512 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.431580] binder: 19505:19509 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.431592] binder: 19505:19509 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.432620] binder: 19505:19509 Release 1 refcount change on invalid ref 0 ret -22 [ 816.432633] binder: 19505:19509 transaction failed 29189/-22, size 0-0 line 3119 [ 816.488147] binder: 19517:19526 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.488161] binder: 19517:19526 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.500805] binder: 19523:19529 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.500818] binder: 19523:19529 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.500941] binder: 19523:19529 Release 1 refcount change on invalid ref 0 ret -22 [ 816.500954] binder: 19523:19529 transaction failed 29189/-22, size 0-0 line 3119 [ 816.530647] binder: 19533:19538 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.530660] binder: 19533:19538 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.582414] binder: 19540:19548 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.582426] binder: 19540:19548 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.582538] binder: 19540:19548 Release 1 refcount change on invalid ref 0 ret -22 [ 816.582551] binder: 19540:19548 transaction failed 29189/-22, size 0-0 line 3119 [ 816.588167] binder: 19547:19550 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.588180] binder: 19547:19550 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.639124] binder: 19558:19562 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.639137] binder: 19558:19562 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.644254] binder: 19555:19564 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.644265] binder: 19555:19564 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.650001] binder: 19555:19564 Release 1 refcount change on invalid ref 0 ret -22 [ 816.650016] binder: 19555:19564 transaction failed 29189/-22, size 0-0 line 3119 [ 816.689804] binder: 19573:19578 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.689818] binder: 19573:19578 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.726997] binder: 19572:19580 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.727010] binder: 19572:19580 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.727137] binder: 19572:19580 Release 1 refcount change on invalid ref 0 ret -22 [ 816.727151] binder: 19572:19580 transaction failed 29189/-22, size 0-0 line 3119 [ 816.749661] binder: 19583:19588 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.749674] binder: 19583:19588 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.785222] binder: 19591:19597 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.785237] binder: 19591:19597 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.785366] binder: 19591:19597 Release 1 refcount change on invalid ref 0 ret -22 [ 816.785379] binder: 19591:19597 transaction failed 29189/-22, size 0-0 line 3119 [ 816.803325] binder: 19598:19606 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.803340] binder: 19598:19606 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.853432] binder: 19611:19614 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.853447] binder: 19611:19614 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.853597] binder: 19611:19614 Release 1 refcount change on invalid ref 0 ret -22 [ 816.853611] binder: 19611:19614 transaction failed 29189/-22, size 0-0 line 3119 [ 816.866431] binder: 19616:19623 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.866447] binder: 19616:19623 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.943525] binder: 19628:19634 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.943541] binder: 19628:19634 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.946502] binder: 19626:19633 Acquire 1 refcount change on invalid ref 0 ret -22 [ 816.946516] binder: 19626:19633 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.946639] binder: 19626:19633 Release 1 refcount change on invalid ref 0 ret -22 [ 816.946653] binder: 19626:19633 transaction failed 29189/-22, size 0-0 line 3119 [ 817.021550] binder: 19649:19657 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.021563] binder: 19649:19657 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.032832] binder: 19651:19661 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.032843] binder: 19651:19661 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.033517] binder: 19651:19661 Release 1 refcount change on invalid ref 0 ret -22 [ 817.033531] binder: 19651:19661 transaction failed 29189/-22, size 0-0 line 3119 [ 817.107940] binder: 19670:19677 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.107954] binder: 19670:19677 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.119040] binder: 19674:19679 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.119055] binder: 19674:19679 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.119208] binder: 19674:19679 Release 1 refcount change on invalid ref 0 ret -22 [ 817.119220] binder: 19674:19679 transaction failed 29189/-22, size 0-0 line 3119 [ 817.156144] binder: 19684:19688 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.156157] binder: 19684:19688 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.160002] binder: 19686:19687 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.160016] binder: 19686:19687 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.160147] binder: 19686:19687 Release 1 refcount change on invalid ref 0 ret -22 [ 817.160160] binder: 19686:19687 transaction failed 29189/-22, size 0-0 line 3119 [ 817.201736] binder: 19696:19699 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.201749] binder: 19696:19699 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.218282] binder: 19697:19701 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.218296] binder: 19697:19701 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.218986] binder: 19697:19701 Release 1 refcount change on invalid ref 0 ret -22 [ 817.219001] binder: 19697:19701 transaction failed 29189/-22, size 0-0 line 3119 [ 817.254772] binder: 19705:19710 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.254785] binder: 19705:19710 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.283861] binder: 19714:19719 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.283874] binder: 19714:19719 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.294249] binder: 19714:19719 Release 1 refcount change on invalid ref 0 ret -22 [ 817.294264] binder: 19714:19719 transaction failed 29189/-22, size 0-0 line 3119 [ 817.304684] binder: 19721:19726 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.304698] binder: 19721:19726 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.345649] binder: 19733:19737 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.345661] binder: 19733:19737 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.348440] binder: 19733:19737 Release 1 refcount change on invalid ref 0 ret -22 [ 817.348454] binder: 19733:19737 transaction failed 29189/-22, size 0-0 line 3119 [ 817.361390] binder: 19730:19739 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.361460] binder: 19730:19739 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.411760] binder: 19747:19752 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.411773] binder: 19747:19752 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.411884] binder: 19747:19752 Release 1 refcount change on invalid ref 0 ret -22 [ 817.411897] binder: 19747:19752 transaction failed 29189/-22, size 0-0 line 3119 [ 817.420746] binder: 19751:19756 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.420760] binder: 19751:19756 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.475326] binder: 19761:19764 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.475339] binder: 19761:19764 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.475698] binder: 19761:19764 Release 1 refcount change on invalid ref 0 ret -22 [ 817.475718] binder: 19761:19764 transaction failed 29189/-22, size 0-0 line 3119 [ 817.502087] binder: 19765:19772 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.502100] binder: 19765:19772 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.510798] binder: 19774:19779 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.510809] binder: 19774:19779 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.510933] binder: 19774:19779 Release 1 refcount change on invalid ref 0 ret -22 [ 817.510946] binder: 19774:19779 transaction failed 29189/-22, size 0-0 line 3119 [ 817.563312] binder: 19784:19790 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.563324] binder: 19784:19790 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.563495] binder: 19784:19790 Release 1 refcount change on invalid ref 0 ret -22 [ 817.563507] binder: 19784:19790 transaction failed 29189/-22, size 0-0 line 3119 [ 817.572639] binder: 19788:19792 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.572652] binder: 19788:19792 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.628038] binder: 19802:19805 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.628052] binder: 19802:19805 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.628175] binder: 19802:19805 Release 1 refcount change on invalid ref 0 ret -22 [ 817.628188] binder: 19802:19805 transaction failed 29189/-22, size 0-0 line 3119 [ 817.638600] binder: 19799:19804 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.638615] binder: 19799:19804 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.697391] binder: 19818:19820 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.697403] binder: 19818:19820 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.697522] binder: 19818:19820 Release 1 refcount change on invalid ref 0 ret -22 [ 817.697533] binder: 19818:19820 transaction failed 29189/-22, size 0-0 line 3119 [ 817.743687] binder: 19826:19837 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.743836] binder: 19826:19837 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.745473] binder: 19833:19836 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.745488] binder: 19833:19836 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.745917] binder: 19833:19836 Release 1 refcount change on invalid ref 0 ret -22 [ 817.745930] binder: 19833:19836 transaction failed 29189/-22, size 0-0 line 3119 [ 817.823900] binder: 19846:19853 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.823915] binder: 19846:19853 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.825318] binder: 19850:19854 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.825330] binder: 19850:19854 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.825761] binder: 19850:19854 Release 1 refcount change on invalid ref 0 ret -22 [ 817.825776] binder: 19850:19854 transaction failed 29189/-22, size 0-0 line 3119 [ 817.868241] binder: 19857:19865 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.868252] binder: 19857:19865 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.868326] binder: 19860:19864 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.868340] binder: 19860:19864 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.868365] binder: 19857:19865 Release 1 refcount change on invalid ref 0 ret -22 [ 817.868378] binder: 19857:19865 transaction failed 29189/-22, size 0-0 line 3119 [ 817.925156] binder: 19873:19877 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.925170] binder: 19873:19877 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.925290] binder: 19873:19877 Release 1 refcount change on invalid ref 0 ret -22 [ 817.925304] binder: 19873:19877 transaction failed 29189/-22, size 0-0 line 3119 [ 817.936415] binder: 19876:19878 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.936428] binder: 19876:19878 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.984327] binder: 19887:19892 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.984341] binder: 19887:19892 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.984724] binder: 19887:19892 Release 1 refcount change on invalid ref 0 ret -22 [ 817.984737] binder: 19887:19892 transaction failed 29189/-22, size 0-0 line 3119 [ 817.985448] binder: 19889:19893 Acquire 1 refcount change on invalid ref 0 ret -22 [ 817.985460] binder: 19889:19893 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.024544] binder: 19900:19906 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.024557] binder: 19900:19906 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.070357] binder: 19899:19908 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.070369] binder: 19899:19908 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.070506] binder: 19899:19908 Release 1 refcount change on invalid ref 0 ret -22 [ 818.070520] binder: 19899:19908 transaction failed 29189/-22, size 0-0 line 3119 [ 818.102759] binder: 19916:19923 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.102772] binder: 19916:19923 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.110148] binder: 19918:19926 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.110161] binder: 19918:19926 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.110298] binder: 19918:19926 Release 1 refcount change on invalid ref 0 ret -22 [ 818.110311] binder: 19918:19926 transaction failed 29189/-22, size 0-0 line 3119 [ 818.155210] binder: 19936:19938 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.155223] binder: 19936:19938 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.181954] binder: 19935:19942 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.181969] binder: 19935:19942 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.182109] binder: 19935:19942 Release 1 refcount change on invalid ref 0 ret -22 [ 818.182123] binder: 19935:19942 transaction failed 29189/-22, size 0-0 line 3119 [ 818.195780] binder: 19944:19946 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.195793] binder: 19944:19946 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.234573] binder: 19948:19956 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.234587] binder: 19948:19956 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.234766] binder: 19948:19956 Release 1 refcount change on invalid ref 0 ret -22 [ 818.234779] binder: 19948:19956 transaction failed 29189/-22, size 0-0 line 3119 [ 818.255680] binder: 19958:19963 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.255899] binder: 19958:19963 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.312553] binder: 19967:19974 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.312567] binder: 19967:19974 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.314747] binder: 19967:19974 Release 1 refcount change on invalid ref 0 ret -22 [ 818.314760] binder: 19967:19974 transaction failed 29189/-22, size 0-0 line 3119 [ 818.329023] binder: 19977:19980 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.329036] binder: 19977:19980 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.374558] binder: 19985:19989 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.374571] binder: 19985:19989 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.376724] binder: 19985:19989 Release 1 refcount change on invalid ref 0 ret -22 [ 818.376737] binder: 19985:19989 transaction failed 29189/-22, size 0-0 line 3119 [ 818.409554] binder: 19992:19998 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.409567] binder: 19992:19998 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.458829] binder: 20000:20009 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.458841] binder: 20000:20009 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.459006] binder: 20003:20008 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.459013] binder: 20000:20009 Release 1 refcount change on invalid ref 0 ret -22 [ 818.459018] binder: 20003:20008 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.459026] binder: 20000:20009 transaction failed 29189/-22, size 0-0 line 3119 [ 818.526253] binder: 20021:20027 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.526269] binder: 20021:20027 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.526635] binder: 20021:20027 Release 1 refcount change on invalid ref 0 ret -22 [ 818.526648] binder: 20021:20027 transaction failed 29189/-22, size 0-0 line 3119 [ 818.528550] binder: 20017:20028 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.528563] binder: 20017:20028 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.611578] binder: 20034:20042 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.611591] binder: 20034:20042 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.615356] binder: 20040:20045 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.615368] binder: 20040:20045 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.616439] binder: 20040:20045 Release 1 refcount change on invalid ref 0 ret -22 [ 818.616452] binder: 20040:20045 transaction failed 29189/-22, size 0-0 line 3119 [ 818.670173] binder: 20051:20059 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.670357] binder: 20051:20059 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.672036] binder: 20052:20060 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.672049] binder: 20052:20060 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.672176] binder: 20052:20060 Release 1 refcount change on invalid ref 0 ret -22 [ 818.672189] binder: 20052:20060 transaction failed 29189/-22, size 0-0 line 3119 [ 818.733666] binder: 20069:20075 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.733679] binder: 20069:20075 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.733784] binder: 20069:20075 Release 1 refcount change on invalid ref 0 ret -22 [ 818.733797] binder: 20069:20075 transaction failed 29189/-22, size 0-0 line 3119 [ 818.764121] binder: 20073:20084 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.764135] binder: 20073:20084 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.799697] binder: 20082:20086 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.799712] binder: 20082:20086 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.799856] binder: 20082:20086 Release 1 refcount change on invalid ref 0 ret -22 [ 818.799869] binder: 20082:20086 transaction failed 29189/-22, size 0-0 line 3119 [ 818.848041] binder: 20097:20102 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.848055] binder: 20097:20102 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.852006] binder: 20101:20105 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.852018] binder: 20101:20105 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.852141] binder: 20101:20105 Release 1 refcount change on invalid ref 0 ret -22 [ 818.852154] binder: 20101:20105 transaction failed 29189/-22, size 0-0 line 3119 [ 818.901075] binder: 20110:20115 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.901089] binder: 20110:20115 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.901214] binder: 20110:20115 Release 1 refcount change on invalid ref 0 ret -22 [ 818.901227] binder: 20110:20115 transaction failed 29189/-22, size 0-0 line 3119 [ 818.904293] binder: 20112:20118 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.904303] binder: 20112:20118 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.950775] binder: 20123:20126 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.950788] binder: 20123:20126 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.951202] binder: 20123:20126 Release 1 refcount change on invalid ref 0 ret -22 [ 818.951215] binder: 20123:20126 transaction failed 29189/-22, size 0-0 line 3119 [ 818.990849] binder: 20129:20139 Acquire 1 refcount change on invalid ref 0 ret -22 [ 818.990861] binder: 20129:20139 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.030273] binder: 20140:20144 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.030286] binder: 20140:20144 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.031455] binder: 20140:20144 Release 1 refcount change on invalid ref 0 ret -22 [ 819.031469] binder: 20140:20144 transaction failed 29189/-22, size 0-0 line 3119 [ 819.053612] binder: 20148:20152 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.053625] binder: 20148:20152 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.097598] binder: 20157:20162 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.097612] binder: 20157:20162 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.097742] binder: 20157:20162 Release 1 refcount change on invalid ref 0 ret -22 [ 819.097756] binder: 20157:20162 transaction failed 29189/-22, size 0-0 line 3119 [ 819.126436] binder: 20165:20171 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.126448] binder: 20165:20171 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.149012] binder: 20172:20179 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.149025] binder: 20172:20179 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.149155] binder: 20172:20179 Release 1 refcount change on invalid ref 0 ret -22 [ 819.149168] binder: 20172:20179 transaction failed 29189/-22, size 0-0 line 3119 [ 819.193532] binder: 20180:20184 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.193546] binder: 20180:20184 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.205358] binder: 20190:20193 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.205370] binder: 20190:20193 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.205635] binder: 20190:20193 Release 1 refcount change on invalid ref 0 ret -22 [ 819.205648] binder: 20190:20193 transaction failed 29189/-22, size 0-0 line 3119 [ 819.261914] binder: 20199:20201 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.261928] binder: 20199:20201 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.272789] binder: 20203:20209 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.272802] binder: 20203:20209 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.273180] binder: 20203:20209 Release 1 refcount change on invalid ref 0 ret -22 [ 819.273194] binder: 20203:20209 transaction failed 29189/-22, size 0-0 line 3119 [ 819.308444] binder: 20213:20216 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.308457] binder: 20213:20216 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.344056] binder: 20218:20221 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.344069] binder: 20218:20221 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.344189] binder: 20218:20221 Release 1 refcount change on invalid ref 0 ret -22 [ 819.344203] binder: 20218:20221 transaction failed 29189/-22, size 0-0 line 3119 [ 819.367905] binder: 20225:20227 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.367918] binder: 20225:20227 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.398924] binder: 20232:20238 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.398938] binder: 20232:20238 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.399056] binder: 20232:20238 Release 1 refcount change on invalid ref 0 ret -22 [ 819.399069] binder: 20232:20238 transaction failed 29189/-22, size 0-0 line 3119 [ 819.431415] binder: 20240:20242 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.431428] binder: 20240:20242 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.477505] binder: 20247:20255 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.477518] binder: 20247:20255 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.478609] binder: 20247:20255 Release 1 refcount change on invalid ref 0 ret -22 [ 819.478623] binder: 20247:20255 transaction failed 29189/-22, size 0-0 line 3119 [ 819.484911] binder: 20256:20259 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.484924] binder: 20256:20259 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.538603] binder: 20270:20275 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.538615] binder: 20270:20275 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.539628] binder: 20270:20275 Release 1 refcount change on invalid ref 0 ret -22 [ 819.539643] binder: 20270:20275 transaction failed 29189/-22, size 0-0 line 3119 [ 819.544115] binder: 20265:20266 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.544129] binder: 20265:20266 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.594635] binder: 20279:20284 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.594648] binder: 20279:20284 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.599737] binder: 20280:20287 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.599749] binder: 20280:20287 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.602365] binder: 20280:20287 Release 1 refcount change on invalid ref 0 ret -22 [ 819.602386] binder: 20280:20287 transaction failed 29189/-22, size 0-0 line 3119 [ 819.631994] binder: 20293:20294 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.632008] binder: 20293:20294 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.651306] binder: 20299:20303 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.651319] binder: 20299:20303 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.651448] binder: 20299:20303 Release 1 refcount change on invalid ref 0 ret -22 [ 819.651461] binder: 20299:20303 transaction failed 29189/-22, size 0-0 line 3119 [ 819.694796] binder: 20308:20314 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.694810] binder: 20308:20314 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.712628] binder: 20312:20316 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.712644] binder: 20312:20316 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.712781] binder: 20312:20316 Release 1 refcount change on invalid ref 0 ret -22 [ 819.712795] binder: 20312:20316 transaction failed 29189/-22, size 0-0 line 3119 [ 819.760693] binder: 20322:20327 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.760731] binder: 20322:20327 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.809355] binder: 20332:20335 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.809484] binder: 20332:20335 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.810361] binder: 20332:20335 Release 1 refcount change on invalid ref 0 ret -22 [ 819.810375] binder: 20332:20335 transaction failed 29189/-22, size 0-0 line 3119 [ 819.821287] binder: 20341:20346 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.821301] binder: 20341:20346 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.856335] binder: 20348:20350 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.856349] binder: 20348:20350 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.856474] binder: 20348:20350 Release 1 refcount change on invalid ref 0 ret -22 [ 819.856487] binder: 20348:20350 transaction failed 29189/-22, size 0-0 line 3119 [ 819.899405] binder: 20351:20355 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.899419] binder: 20351:20355 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.919739] binder: 20361:20367 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.919751] binder: 20361:20367 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.920442] binder: 20361:20367 Release 1 refcount change on invalid ref 0 ret -22 [ 819.920456] binder: 20361:20367 transaction failed 29189/-22, size 0-0 line 3119 [ 819.930219] binder: 20369:20372 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.930232] binder: 20369:20372 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.973698] binder: 20377:20382 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.973709] binder: 20377:20382 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.973823] binder: 20377:20382 Release 1 refcount change on invalid ref 0 ret -22 [ 819.973835] binder: 20377:20382 transaction failed 29189/-22, size 0-0 line 3119 [ 819.990419] binder: 20381:20384 Acquire 1 refcount change on invalid ref 0 ret -22 [ 819.990432] binder: 20381:20384 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.026422] binder: 20394:20396 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.026436] binder: 20394:20396 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.026572] binder: 20394:20396 Release 1 refcount change on invalid ref 0 ret -22 [ 820.026584] binder: 20394:20396 transaction failed 29189/-22, size 0-0 line 3119 [ 820.058564] binder: 20399:20408 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.062084] binder: 20399:20408 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.087917] binder: 20409:20412 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.087930] binder: 20409:20412 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.088358] binder: 20409:20412 Release 1 refcount change on invalid ref 0 ret -22 [ 820.088372] binder: 20409:20412 transaction failed 29189/-22, size 0-0 line 3119 [ 820.098874] binder: 20411:20415 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.098887] binder: 20411:20415 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.156700] binder: 20421:20426 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.156714] binder: 20421:20426 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.162005] binder: 20419:20427 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.162018] binder: 20419:20427 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.162151] binder: 20419:20427 Release 1 refcount change on invalid ref 0 ret -22 [ 820.162165] binder: 20419:20427 transaction failed 29189/-22, size 0-0 line 3119 [ 820.228035] binder: 20436:20439 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.228048] binder: 20436:20439 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.233037] binder: 20435:20440 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.233050] binder: 20435:20440 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.233182] binder: 20435:20440 Release 1 refcount change on invalid ref 0 ret -22 [ 820.233196] binder: 20435:20440 transaction failed 29189/-22, size 0-0 line 3119 [ 820.276224] binder: 20447:20455 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.276236] binder: 20447:20455 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.295629] binder: 20453:20456 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.295643] binder: 20453:20456 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.296476] binder: 20453:20456 Release 1 refcount change on invalid ref 0 ret -22 [ 820.296491] binder: 20453:20456 transaction failed 29189/-22, size 0-0 line 3119 [ 820.367831] binder: 20468:20473 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.367843] binder: 20468:20473 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.367992] binder: 20468:20473 Release 1 refcount change on invalid ref 0 ret -22 [ 820.368005] binder: 20468:20473 transaction failed 29189/-22, size 0-0 line 3119 [ 820.370491] binder: 20465:20472 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.370504] binder: 20465:20472 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.429370] binder: 20485:20488 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.429393] binder: 20485:20488 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.429524] binder: 20485:20488 Release 1 refcount change on invalid ref 0 ret -22 [ 820.429538] binder: 20485:20488 transaction failed 29189/-22, size 0-0 line 3119 [ 820.451973] binder: 20483:20492 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.451985] binder: 20483:20492 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.482986] binder: 20498:20500 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.483001] binder: 20498:20500 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.483176] binder: 20498:20500 Release 1 refcount change on invalid ref 0 ret -22 [ 820.483190] binder: 20498:20500 transaction failed 29189/-22, size 0-0 line 3119 [ 820.531327] binder: 20505:20512 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.531341] binder: 20505:20512 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.550630] binder: 20514:20517 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.550644] binder: 20514:20517 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.550773] binder: 20514:20517 Release 1 refcount change on invalid ref 0 ret -22 [ 820.550787] binder: 20514:20517 transaction failed 29189/-22, size 0-0 line 3119 [ 820.601491] binder: 20526:20530 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.601504] binder: 20526:20530 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.601642] binder: 20526:20530 Release 1 refcount change on invalid ref 0 ret -22 [ 820.601655] binder: 20526:20530 transaction failed 29189/-22, size 0-0 line 3119 [ 820.609033] binder: 20524:20531 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.609046] binder: 20524:20531 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.651211] binder: 20539:20540 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.651224] binder: 20539:20540 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.651343] binder: 20539:20540 Release 1 refcount change on invalid ref 0 ret -22 [ 820.651356] binder: 20539:20540 transaction failed 29189/-22, size 0-0 line 3119 [ 820.674221] binder: 20542:20546 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.674236] binder: 20542:20546 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.727467] binder: 20552:20557 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.727481] binder: 20552:20557 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.727616] binder: 20552:20557 Release 1 refcount change on invalid ref 0 ret -22 [ 820.727630] binder: 20552:20557 transaction failed 29189/-22, size 0-0 line 3119 [ 820.729407] binder: 20556:20560 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.729420] binder: 20556:20560 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.786507] binder: 20569:20575 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.786521] binder: 20569:20575 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.800122] binder: 20567:20576 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.800136] binder: 20567:20576 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.800370] binder: 20567:20576 Release 1 refcount change on invalid ref 0 ret -22 [ 820.800383] binder: 20567:20576 transaction failed 29189/-22, size 0-0 line 3119 [ 820.853635] binder: 20583:20587 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.853648] binder: 20583:20587 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.854733] binder: 20583:20587 Release 1 refcount change on invalid ref 0 ret -22 [ 820.854746] binder: 20583:20587 transaction failed 29189/-22, size 0-0 line 3119 [ 820.880882] binder: 20588:20594 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.880896] binder: 20588:20594 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.895159] binder: 20598:20599 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.895170] binder: 20598:20599 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.895273] binder: 20598:20599 Release 1 refcount change on invalid ref 0 ret -22 [ 820.895286] binder: 20598:20599 transaction failed 29189/-22, size 0-0 line 3119 [ 820.936343] binder: 20607:20610 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.936356] binder: 20607:20610 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.936482] binder: 20607:20610 Release 1 refcount change on invalid ref 0 ret -22 [ 820.936494] binder: 20607:20610 transaction failed 29189/-22, size 0-0 line 3119 [ 820.989935] binder: 20615:20619 Acquire 1 refcount change on invalid ref 0 ret -22 [ 820.990163] binder: 20615:20619 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.027266] binder: 20625:20627 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.027279] binder: 20625:20627 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.028179] binder: 20625:20627 Release 1 refcount change on invalid ref 0 ret -22 [ 821.028192] binder: 20625:20627 transaction failed 29189/-22, size 0-0 line 3119 [ 821.056455] binder: 20630:20637 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.056469] binder: 20630:20637 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.093408] binder: 20641:20644 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.093423] binder: 20641:20644 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.093547] binder: 20641:20644 Release 1 refcount change on invalid ref 0 ret -22 [ 821.093560] binder: 20641:20644 transaction failed 29189/-22, size 0-0 line 3119 [ 821.133133] binder: 20651:20656 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.133147] binder: 20651:20656 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.147903] binder: 20655:20661 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.147916] binder: 20655:20661 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.148046] binder: 20655:20661 Release 1 refcount change on invalid ref 0 ret -22 [ 821.148059] binder: 20655:20661 transaction failed 29189/-22, size 0-0 line 3119 [ 821.199236] binder: 20664:20676 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.199250] binder: 20664:20676 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.225950] binder: 20675:20677 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.225961] binder: 20675:20677 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.226480] binder: 20675:20677 Release 1 refcount change on invalid ref 0 ret -22 [ 821.226495] binder: 20675:20677 transaction failed 29189/-22, size 0-0 line 3119 [ 821.267769] binder: 20685:20692 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.267782] binder: 20685:20692 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.296597] binder: 20690:20698 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.296610] binder: 20690:20698 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.297652] binder: 20690:20698 Release 1 refcount change on invalid ref 0 ret -22 [ 821.297666] binder: 20690:20698 transaction failed 29189/-22, size 0-0 line 3119 [ 821.332307] binder: 20700:20707 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.332321] binder: 20700:20707 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.388009] binder: 20705:20717 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.388025] binder: 20705:20717 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.388738] binder: 20705:20717 Release 1 refcount change on invalid ref 0 ret -22 [ 821.388752] binder: 20705:20717 transaction failed 29189/-22, size 0-0 line 3119 [ 821.402067] binder: 20716:20718 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.402079] binder: 20716:20718 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.465523] binder: 20729:20740 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.465536] binder: 20729:20740 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.465676] binder: 20729:20740 Release 1 refcount change on invalid ref 0 ret -22 [ 821.465688] binder: 20729:20740 transaction failed 29189/-22, size 0-0 line 3119 [ 821.467812] binder: 20736:20741 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.467824] binder: 20736:20741 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.524686] binder: 20747:20751 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.524701] binder: 20747:20751 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.575603] binder: 20755:20760 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.575616] binder: 20755:20760 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.576221] binder: 20755:20760 Release 1 refcount change on invalid ref 0 ret -22 [ 821.576236] binder: 20755:20760 transaction failed 29189/-22, size 0-0 line 3119 [ 821.603074] binder: 20759:20765 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.603087] binder: 20759:20765 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.635780] binder: 20777:20781 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.635794] binder: 20777:20781 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.635916] binder: 20777:20781 Release 1 refcount change on invalid ref 0 ret -22 [ 821.635929] binder: 20777:20781 transaction failed 29189/-22, size 0-0 line 3119 [ 821.674528] binder: 20779:20783 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.674542] binder: 20779:20783 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.722703] binder: 20788:20794 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.722717] binder: 20788:20794 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.724270] binder: 20788:20794 Release 1 refcount change on invalid ref 0 ret -22 [ 821.724284] binder: 20788:20794 transaction failed 29189/-22, size 0-0 line 3119 [ 821.746491] binder: 20796:20799 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.746506] binder: 20796:20799 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.806008] binder: 20806:20810 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.806021] binder: 20806:20810 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.841599] binder: 20812:20817 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.841612] binder: 20812:20817 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.841747] binder: 20812:20817 Release 1 refcount change on invalid ref 0 ret -22 [ 821.841759] binder: 20812:20817 transaction failed 29189/-22, size 0-0 line 3119 [ 821.858262] binder: 20823:20827 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.858276] binder: 20823:20827 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.890970] binder: 20832:20836 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.890982] binder: 20832:20836 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.930746] binder: 20828:20841 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.930760] binder: 20828:20841 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.930887] binder: 20828:20841 Release 1 refcount change on invalid ref 0 ret -22 [ 821.930900] binder: 20828:20841 transaction failed 29189/-22, size 0-0 line 3119 [ 821.952580] binder: 20842:20848 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.952593] binder: 20842:20848 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.993095] binder: 20856:20861 Acquire 1 refcount change on invalid ref 0 ret -22 [ 821.993108] binder: 20856:20861 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.993278] binder: 20856:20861 Release 1 refcount change on invalid ref 0 ret -22 [ 821.993291] binder: 20856:20861 transaction failed 29189/-22, size 0-0 line 3119 [ 822.003239] binder: 20859:20863 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.003252] binder: 20859:20863 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.041630] binder: 20867:20872 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.041644] binder: 20867:20872 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.041765] binder: 20867:20872 Release 1 refcount change on invalid ref 0 ret -22 [ 822.041779] binder: 20867:20872 transaction failed 29189/-22, size 0-0 line 3119 [ 822.067275] binder: 20870:20875 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.067298] binder: 20870:20875 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.099455] binder: 20881:20882 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.099470] binder: 20881:20882 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.100279] binder: 20881:20882 Release 1 refcount change on invalid ref 0 ret -22 [ 822.100294] binder: 20881:20882 transaction failed 29189/-22, size 0-0 line 3119 [ 822.130338] binder: 20890:20897 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.130351] binder: 20890:20897 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.133864] binder: 20893:20898 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.133884] binder: 20893:20898 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.134007] binder: 20893:20898 Release 1 refcount change on invalid ref 0 ret -22 [ 822.134020] binder: 20893:20898 transaction failed 29189/-22, size 0-0 line 3119 [ 822.178990] binder: 20900:20904 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.179003] binder: 20900:20904 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.219888] binder: 20911:20918 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.219901] binder: 20911:20918 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.220728] binder: 20911:20918 Release 1 refcount change on invalid ref 0 ret -22 [ 822.220743] binder: 20911:20918 transaction failed 29189/-22, size 0-0 line 3119 [ 822.232722] binder: 20915:20921 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.232736] binder: 20915:20921 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.294818] binder: 20929:20933 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.294832] binder: 20929:20933 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.304797] binder: 20930:20935 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.304811] binder: 20930:20935 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.305273] binder: 20930:20935 Release 1 refcount change on invalid ref 0 ret -22 [ 822.305288] binder: 20930:20935 transaction failed 29189/-22, size 0-0 line 3119 [ 822.347019] binder: 20944:20948 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.347033] binder: 20944:20948 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.348637] binder: 20942:20949 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.348649] binder: 20942:20949 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.348767] binder: 20942:20949 Release 1 refcount change on invalid ref 0 ret -22 [ 822.348780] binder: 20942:20949 transaction failed 29189/-22, size 0-0 line 3119 [ 822.402475] binder: 20960:20962 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.402489] binder: 20960:20962 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.402592] binder: 20960:20962 Release 1 refcount change on invalid ref 0 ret -22 [ 822.402605] binder: 20960:20962 transaction failed 29189/-22, size 0-0 line 3119 [ 822.418534] binder: 20959:20961 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.418548] binder: 20959:20961 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.476140] binder: 20971:20976 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.476154] binder: 20971:20976 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.476278] binder: 20971:20976 Release 1 refcount change on invalid ref 0 ret -22 [ 822.476292] binder: 20971:20976 transaction failed 29189/-22, size 0-0 line 3119 [ 822.489238] binder: 20973:20982 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.489251] binder: 20973:20982 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.543871] binder: 20988:20997 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.543884] binder: 20988:20997 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.544639] binder: 20988:20997 Release 1 refcount change on invalid ref 0 ret -22 [ 822.544653] binder: 20988:20997 transaction failed 29189/-22, size 0-0 line 3119 [ 822.574297] binder: 20991:21004 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.574310] binder: 20991:21004 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.626984] binder: 21006:21013 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.626997] binder: 21006:21013 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.627499] binder: 21006:21013 Release 1 refcount change on invalid ref 0 ret -22 [ 822.627514] binder: 21006:21013 transaction failed 29189/-22, size 0-0 line 3119 [ 822.658089] binder: 21017:21020 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.658102] binder: 21017:21020 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.698788] binder: 21026:21033 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.698802] binder: 21026:21033 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.698956] binder: 21026:21033 Release 1 refcount change on invalid ref 0 ret -22 [ 822.698973] binder: 21026:21033 transaction failed 29189/-22, size 0-0 line 3119 [ 822.730781] binder: 21035:21043 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.730794] binder: 21035:21043 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.762567] binder: 21046:21050 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.762580] binder: 21046:21050 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.771358] binder: 21046:21050 Release 1 refcount change on invalid ref 0 ret -22 [ 822.771372] binder: 21046:21050 transaction failed 29189/-22, size 0-0 line 3119 [ 822.803593] binder: 21056:21059 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.803606] binder: 21056:21059 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.838442] binder: 21063:21067 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.838455] binder: 21063:21067 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.838582] binder: 21063:21067 Release 1 refcount change on invalid ref 0 ret -22 [ 822.838594] binder: 21063:21067 transaction failed 29189/-22, size 0-0 line 3119 [ 822.864678] binder: 21070:21076 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.864691] binder: 21070:21076 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.918373] binder: 21080:21084 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.918385] binder: 21080:21084 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.922801] binder: 21080:21084 Release 1 refcount change on invalid ref 0 ret -22 [ 822.922816] binder: 21080:21084 transaction failed 29189/-22, size 0-0 line 3119 [ 822.934408] binder: 21087:21093 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.934422] binder: 21087:21093 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.985483] binder: 21095:21099 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.985496] binder: 21095:21099 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.986493] binder: 21095:21099 Release 1 refcount change on invalid ref 0 ret -22 [ 822.986508] binder: 21095:21099 transaction failed 29189/-22, size 0-0 line 3119 [ 822.995434] binder: 21098:21109 Acquire 1 refcount change on invalid ref 0 ret -22 [ 822.995446] binder: 21098:21109 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.048629] binder: 21116:21119 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.048642] binder: 21116:21119 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.048756] binder: 21116:21119 Release 1 refcount change on invalid ref 0 ret -22 [ 823.048770] binder: 21116:21119 transaction failed 29189/-22, size 0-0 line 3119 [ 823.052371] binder: 21117:21118 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.052382] binder: 21117:21118 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.115080] binder: 21129:21133 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.115101] binder: 21129:21133 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.119763] binder: 21130:21138 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.119775] binder: 21130:21138 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.129309] binder: 21129:21133 Release 1 refcount change on invalid ref 0 ret -22 [ 823.129325] binder: 21129:21133 transaction failed 29189/-22, size 0-0 line 3119 [ 823.189895] binder: 21150:21154 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.189907] binder: 21150:21154 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.190041] binder: 21150:21154 Release 1 refcount change on invalid ref 0 ret -22 [ 823.190053] binder: 21150:21154 transaction failed 29189/-22, size 0-0 line 3119 [ 823.198664] binder: 21146:21155 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.198678] binder: 21146:21155 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.265300] binder: 21163:21166 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.265313] binder: 21163:21166 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.265739] binder: 21163:21166 Release 1 refcount change on invalid ref 0 ret -22 [ 823.265751] binder: 21163:21166 transaction failed 29189/-22, size 0-0 line 3119 [ 823.267835] binder: 21167:21174 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.267847] binder: 21167:21174 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.337858] binder: 21187:21191 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.337871] binder: 21187:21191 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.339128] binder: 21188:21192 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.339140] binder: 21188:21192 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.339245] binder: 21188:21192 Release 1 refcount change on invalid ref 0 ret -22 [ 823.339258] binder: 21188:21192 transaction failed 29189/-22, size 0-0 line 3119 [ 823.400997] binder: 21196:21207 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.401010] binder: 21196:21207 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.401118] binder: 21196:21207 Release 1 refcount change on invalid ref 0 ret -22 [ 823.403293] binder: 21196:21207 transaction failed 29189/-22, size 0-0 line 3119 [ 823.417123] binder: 21203:21209 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.417136] binder: 21203:21209 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.465985] binder: 21219:21226 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.465998] binder: 21219:21226 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.482093] binder: 21218:21225 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.482107] binder: 21218:21225 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.482253] binder: 21218:21225 Release 1 refcount change on invalid ref 0 ret -22 [ 823.482267] binder: 21218:21225 transaction failed 29189/-22, size 0-0 line 3119 [ 823.635868] binder: 21241:21250 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.635890] binder: 21241:21250 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.638223] binder: 21248:21252 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.638235] binder: 21248:21252 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.638400] binder: 21248:21252 Release 1 refcount change on invalid ref 0 ret -22 [ 823.638413] binder: 21248:21252 transaction failed 29189/-22, size 0-0 line 3119 [ 823.704050] binder: 21259:21268 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.704063] binder: 21259:21268 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.711686] binder: 21262:21269 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.711699] binder: 21262:21269 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.711835] binder: 21262:21269 Release 1 refcount change on invalid ref 0 ret -22 [ 823.711848] binder: 21262:21269 transaction failed 29189/-22, size 0-0 line 3119 [ 823.762901] binder: 21272:21279 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.762919] binder: 21272:21279 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.771168] binder: 21274:21280 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.771181] binder: 21274:21280 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.773147] binder: 21274:21280 Release 1 refcount change on invalid ref 0 ret -22 [ 823.773161] binder: 21274:21280 transaction failed 29189/-22, size 0-0 line 3119 [ 823.815390] binder: 21287:21291 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.815405] binder: 21287:21291 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.815541] binder: 21287:21291 Release 1 refcount change on invalid ref 0 ret -22 [ 823.815553] binder: 21287:21291 transaction failed 29189/-22, size 0-0 line 3119 [ 823.837998] binder: 21292:21299 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.838011] binder: 21292:21299 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.879475] binder: 21302:21309 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.879487] binder: 21302:21309 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.879609] binder: 21302:21309 Release 1 refcount change on invalid ref 0 ret -22 [ 823.879621] binder: 21302:21309 transaction failed 29189/-22, size 0-0 line 3119 [ 823.899738] binder: 21306:21310 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.899752] binder: 21306:21310 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.943779] binder: 21318:21323 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.943793] binder: 21318:21323 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.943945] binder: 21318:21323 Release 1 refcount change on invalid ref 0 ret -22 [ 823.943961] binder: 21318:21323 transaction failed 29189/-22, size 0-0 line 3119 [ 823.956149] binder: 21321:21326 Acquire 1 refcount change on invalid ref 0 ret -22 [ 823.956164] binder: 21321:21326 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.006376] binder: 21334:21339 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.006388] binder: 21334:21339 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.007954] binder: 21334:21339 Release 1 refcount change on invalid ref 0 ret -22 [ 824.007968] binder: 21334:21339 transaction failed 29189/-22, size 0-0 line 3119 [ 824.015305] binder: 21335:21341 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.015318] binder: 21335:21341 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.080669] binder: 21348:21355 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.080682] binder: 21348:21355 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.092446] binder: 21351:21359 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.092460] binder: 21351:21359 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.092643] binder: 21351:21359 Release 1 refcount change on invalid ref 0 ret -22 [ 824.092656] binder: 21351:21359 transaction failed 29189/-22, size 0-0 line 3119 [ 824.157982] binder: 21365:21372 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.157995] binder: 21365:21372 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.165719] binder: 21370:21375 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.165731] binder: 21370:21375 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.166743] binder: 21370:21375 Release 1 refcount change on invalid ref 0 ret -22 [ 824.166757] binder: 21370:21375 transaction failed 29189/-22, size 0-0 line 3119 [ 824.232027] binder: 21387:21394 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.232039] binder: 21387:21394 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.267554] binder: 21390:21396 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.267568] binder: 21390:21396 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.268270] binder: 21390:21396 Release 1 refcount change on invalid ref 0 ret -22 [ 824.268283] binder: 21390:21396 transaction failed 29189/-22, size 0-0 line 3119 [ 824.299787] binder: 21401:21409 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.299802] binder: 21401:21409 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.337697] binder: 21413:21419 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.337711] binder: 21413:21419 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.337844] binder: 21413:21419 Release 1 refcount change on invalid ref 0 ret -22 [ 824.337861] binder: 21413:21419 transaction failed 29189/-22, size 0-0 line 3119 [ 824.373663] binder: 21425:21429 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.373676] binder: 21425:21429 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.373789] binder: 21425:21429 Release 1 refcount change on invalid ref 0 ret -22 [ 824.373802] binder: 21425:21429 transaction failed 29189/-22, size 0-0 line 3119 [ 824.375522] binder: 21420:21428 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.375534] binder: 21420:21428 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.432507] binder: 21433:21437 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.432522] binder: 21433:21437 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.441785] binder: 21440:21444 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.441799] binder: 21440:21444 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.441917] binder: 21440:21444 Release 1 refcount change on invalid ref 0 ret -22 [ 824.441930] binder: 21440:21444 transaction failed 29189/-22, size 0-0 line 3119 [ 824.501214] binder: 21454:21458 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.501229] binder: 21454:21458 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.501559] binder: 21454:21458 Release 1 refcount change on invalid ref 0 ret -22 [ 824.501572] binder: 21454:21458 transaction failed 29189/-22, size 0-0 line 3119 [ 824.507532] binder: 21453:21462 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.507545] binder: 21453:21462 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.561493] binder: 21465:21474 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.561507] binder: 21465:21474 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.561616] binder: 21465:21474 Release 1 refcount change on invalid ref 0 ret -22 [ 824.561628] binder: 21465:21474 transaction failed 29189/-22, size 0-0 line 3119 [ 824.595836] binder: 21471:21478 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.595848] binder: 21471:21478 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.631129] binder: 21488:21494 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.631142] binder: 21488:21494 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.635313] binder: 21488:21494 Release 1 refcount change on invalid ref 0 ret -22 [ 824.635329] binder: 21488:21494 transaction failed 29189/-22, size 0-0 line 3119 [ 824.671840] binder: 21493:21495 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.671853] binder: 21493:21495 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.698723] binder: 21507:21509 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.698741] binder: 21507:21509 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.699039] binder: 21507:21509 Release 1 refcount change on invalid ref 0 ret -22 [ 824.699057] binder: 21507:21509 transaction failed 29189/-22, size 0-0 line 3119 [ 824.732226] binder: 21511:21515 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.732239] binder: 21511:21515 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.770009] binder: 21521:21525 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.770023] binder: 21521:21525 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.770161] binder: 21521:21525 Release 1 refcount change on invalid ref 0 ret -22 [ 824.770174] binder: 21521:21525 transaction failed 29189/-22, size 0-0 line 3119 [ 824.809386] binder: 21526:21530 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.809401] binder: 21526:21530 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.820905] binder: 21536:21540 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.820931] binder: 21536:21540 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.835163] binder: 21536:21540 Release 1 refcount change on invalid ref 0 ret -22 [ 824.835179] binder: 21536:21540 transaction failed 29189/-22, size 0-0 line 3119 [ 824.883578] binder: 21543:21550 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.883591] binder: 21543:21550 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.897122] binder: 21547:21552 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.897134] binder: 21547:21552 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.897245] binder: 21547:21552 Release 1 refcount change on invalid ref 0 ret -22 [ 824.897257] binder: 21547:21552 transaction failed 29189/-22, size 0-0 line 3119 [ 824.925770] binder: 21560:21565 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.925783] binder: 21560:21565 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.965333] binder: 21564:21569 Acquire 1 refcount change on invalid ref 0 ret -22 [ 824.965347] binder: 21564:21569 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.966388] binder: 21564:21569 Release 1 refcount change on invalid ref 0 ret -22 [ 824.966402] binder: 21564:21569 transaction failed 29189/-22, size 0-0 line 3119 [ 825.008513] binder: 21581:21583 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.008527] binder: 21581:21583 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.009074] binder: 21581:21583 Release 1 refcount change on invalid ref 0 ret -22 [ 825.009087] binder: 21581:21583 transaction failed 29189/-22, size 0-0 line 3119 [ 825.026653] binder: 21580:21587 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.026667] binder: 21580:21587 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.045682] binder: 21591:21592 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.045695] binder: 21591:21592 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.045801] binder: 21591:21592 Release 1 refcount change on invalid ref 0 ret -22 [ 825.045815] binder: 21591:21592 transaction failed 29189/-22, size 0-0 line 3119 [ 825.106372] binder: 21602:21605 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.106410] binder: 21602:21605 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.106604] binder: 21602:21605 Release 1 refcount change on invalid ref 0 ret -22 [ 825.106619] binder: 21602:21605 transaction failed 29189/-22, size 0-0 line 3119 [ 825.133013] binder: 21603:21609 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.133027] binder: 21603:21609 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.184441] binder: 21614:21620 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.184456] binder: 21614:21620 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.184600] binder: 21614:21620 Release 1 refcount change on invalid ref 0 ret -22 [ 825.184613] binder: 21614:21620 transaction failed 29189/-22, size 0-0 line 3119 [ 825.215933] binder: 21618:21628 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.215947] binder: 21618:21628 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.245547] binder: 21629:21636 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.245560] binder: 21629:21636 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.248745] binder: 21629:21636 Release 1 refcount change on invalid ref 0 ret -22 [ 825.248759] binder: 21629:21636 transaction failed 29189/-22, size 0-0 line 3119 [ 825.284671] binder: 21638:21645 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.284684] binder: 21638:21645 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.335810] binder: 21641:21653 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.335823] binder: 21641:21653 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.335948] binder: 21641:21653 Release 1 refcount change on invalid ref 0 ret -22 [ 825.335962] binder: 21641:21653 transaction failed 29189/-22, size 0-0 line 3119 [ 825.359090] binder: 21652:21658 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.359103] binder: 21652:21658 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.403575] binder: 21664:21671 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.403589] binder: 21664:21671 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.404189] binder: 21664:21671 Release 1 refcount change on invalid ref 0 ret -22 [ 825.404202] binder: 21664:21671 transaction failed 29189/-22, size 0-0 line 3119 [ 825.420940] binder: 21669:21677 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.420954] binder: 21669:21677 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.470999] binder: 21683:21686 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.471014] binder: 21683:21686 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.471177] binder: 21683:21686 Release 1 refcount change on invalid ref 0 ret -22 [ 825.471190] binder: 21683:21686 transaction failed 29189/-22, size 0-0 line 3119 [ 825.505265] binder: 21687:21693 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.505317] binder: 21687:21693 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.529074] binder: 21695:21702 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.529087] binder: 21695:21702 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.529216] binder: 21695:21702 Release 1 refcount change on invalid ref 0 ret -22 [ 825.529229] binder: 21695:21702 transaction failed 29189/-22, size 0-0 line 3119 [ 825.581320] binder: 21706:21715 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.581333] binder: 21706:21715 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.609772] binder: 21712:21717 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.609785] binder: 21712:21717 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.609912] binder: 21712:21717 Release 1 refcount change on invalid ref 0 ret -22 [ 825.609925] binder: 21712:21717 transaction failed 29189/-22, size 0-0 line 3119 [ 825.649391] binder: 21722:21731 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.649406] binder: 21722:21731 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.656275] binder: 21730:21735 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.656340] binder: 21730:21735 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.657061] binder: 21730:21735 Release 1 refcount change on invalid ref 0 ret -22 [ 825.657075] binder: 21730:21735 transaction failed 29189/-22, size 0-0 line 3119 [ 825.711365] binder: 21742:21747 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.711405] binder: 21742:21747 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.713156] binder: 21742:21747 Release 1 refcount change on invalid ref 0 ret -22 [ 825.713169] binder: 21742:21747 transaction failed 29189/-22, size 0-0 line 3119 [ 825.726273] binder: 21746:21750 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.726286] binder: 21746:21750 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.796764] binder: 21755:21763 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.796777] binder: 21755:21763 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.810758] binder: 21759:21769 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.810771] binder: 21759:21769 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.810898] binder: 21759:21769 Release 1 refcount change on invalid ref 0 ret -22 [ 825.810912] binder: 21759:21769 transaction failed 29189/-22, size 0-0 line 3119 [ 825.849046] binder: 21777:21780 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.849059] binder: 21777:21780 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.882823] binder: 21781:21786 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.882837] binder: 21781:21786 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.883967] binder: 21781:21786 Release 1 refcount change on invalid ref 0 ret -22 [ 825.883982] binder: 21781:21786 transaction failed 29189/-22, size 0-0 line 3119 [ 825.898261] binder: 21789:21793 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.898273] binder: 21789:21793 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.977607] binder: 21799:21807 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.977666] binder: 21799:21807 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.977896] binder: 21799:21807 Release 1 refcount change on invalid ref 0 ret -22 [ 825.977909] binder: 21799:21807 transaction failed 29189/-22, size 0-0 line 3119 [ 825.990727] binder: 21804:21811 Acquire 1 refcount change on invalid ref 0 ret -22 [ 825.990740] binder: 21804:21811 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.040742] binder: 21817:21824 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.040757] binder: 21817:21824 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.040948] binder: 21817:21824 Release 1 refcount change on invalid ref 0 ret -22 [ 826.040962] binder: 21817:21824 transaction failed 29189/-22, size 0-0 line 3119 [ 826.089176] binder: 21825:21836 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.089189] binder: 21825:21836 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.131130] binder: 21835:21841 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.131172] binder: 21835:21841 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.131307] binder: 21835:21841 Release 1 refcount change on invalid ref 0 ret -22 [ 826.131320] binder: 21835:21841 transaction failed 29189/-22, size 0-0 line 3119 [ 826.136673] binder: 21844:21850 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.136685] binder: 21844:21850 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.192759] binder: 21854:21858 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.192773] binder: 21854:21858 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.192904] binder: 21854:21858 Release 1 refcount change on invalid ref 0 ret -22 [ 826.192918] binder: 21854:21858 transaction failed 29189/-22, size 0-0 line 3119 [ 826.193949] binder: 21856:21862 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.193961] binder: 21856:21862 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.253110] binder: 21870:21875 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.253124] binder: 21870:21875 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.260068] binder: 21871:21877 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.260084] binder: 21871:21877 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.260208] binder: 21871:21877 Release 1 refcount change on invalid ref 0 ret -22 [ 826.260223] binder: 21871:21877 transaction failed 29189/-22, size 0-0 line 3119 [ 826.315914] binder: 21882:21884 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.315927] binder: 21882:21884 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.326747] binder: 21885:21894 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.326760] binder: 21885:21894 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.326938] binder: 21885:21894 Release 1 refcount change on invalid ref 0 ret -22 [ 826.326952] binder: 21885:21894 transaction failed 29189/-22, size 0-0 line 3119 [ 826.366097] binder: 21899:21902 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.366111] binder: 21899:21902 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.410429] binder: 21903:21912 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.410443] binder: 21903:21912 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.412990] binder: 21903:21912 Release 1 refcount change on invalid ref 0 ret -22 [ 826.413004] binder: 21903:21912 transaction failed 29189/-22, size 0-0 line 3119 [ 826.463930] binder: 21916:21926 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.463944] binder: 21916:21926 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.464616] binder: 21921:21927 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.464628] binder: 21921:21927 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.464747] binder: 21921:21927 Release 1 refcount change on invalid ref 0 ret -22 [ 826.464760] binder: 21921:21927 transaction failed 29189/-22, size 0-0 line 3119 [ 826.527442] binder: 21937:21941 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.527456] binder: 21937:21941 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.532817] binder: 21934:21942 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.532829] binder: 21934:21942 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.533229] binder: 21934:21942 Release 1 refcount change on invalid ref 0 ret -22 [ 826.533243] binder: 21934:21942 transaction failed 29189/-22, size 0-0 line 3119 [ 826.589560] binder: 21951:21955 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.589574] binder: 21951:21955 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.600690] binder: 21954:21957 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.600704] binder: 21954:21957 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.600816] binder: 21954:21957 Release 1 refcount change on invalid ref 0 ret -22 [ 826.600830] binder: 21954:21957 transaction failed 29189/-22, size 0-0 line 3119 [ 826.660986] binder: 21969:21977 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.661000] binder: 21969:21977 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.661992] binder: 21969:21977 Release 1 refcount change on invalid ref 0 ret -22 [ 826.662005] binder: 21969:21977 transaction failed 29189/-22, size 0-0 line 3119 [ 826.665045] binder: 21967:21970 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.665059] binder: 21967:21970 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.722484] binder: 21983:21989 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.722497] binder: 21983:21989 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.722608] binder: 21983:21989 Release 1 refcount change on invalid ref 0 ret -22 [ 826.722619] binder: 21983:21989 transaction failed 29189/-22, size 0-0 line 3119 [ 826.755709] binder: 21988:21996 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.755722] binder: 21988:21996 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.774661] binder: 21998:22003 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.774675] binder: 21998:22003 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.775392] binder: 21998:22003 Release 1 refcount change on invalid ref 0 ret -22 [ 826.775405] binder: 21998:22003 transaction failed 29189/-22, size 0-0 line 3119 [ 826.832929] binder: 22010:22013 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.832942] binder: 22010:22013 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.840322] binder: 22014:22020 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.840384] binder: 22014:22020 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.841478] binder: 22014:22020 Release 1 refcount change on invalid ref 0 ret -22 [ 826.841492] binder: 22014:22020 transaction failed 29189/-22, size 0-0 line 3119 [ 826.875964] binder: 22024:22030 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.875976] binder: 22024:22030 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.899488] binder: 22028:22033 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.899500] binder: 22028:22033 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.899625] binder: 22028:22033 Release 1 refcount change on invalid ref 0 ret -22 [ 826.899638] binder: 22028:22033 transaction failed 29189/-22, size 0-0 line 3119 [ 826.965289] binder: 22040:22048 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.965304] binder: 22040:22048 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.965443] binder: 22040:22048 Release 1 refcount change on invalid ref 0 ret -22 [ 826.965457] binder: 22040:22048 transaction failed 29189/-22, size 0-0 line 3119 [ 826.976395] binder: 22045:22051 Acquire 1 refcount change on invalid ref 0 ret -22 [ 826.976409] binder: 22045:22051 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.053789] binder: 22058:22062 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.053802] binder: 22058:22062 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.053920] binder: 22058:22062 Release 1 refcount change on invalid ref 0 ret -22 [ 827.053933] binder: 22058:22062 transaction failed 29189/-22, size 0-0 line 3119 [ 827.077168] binder: 22063:22071 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.077185] binder: 22063:22071 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.136734] binder: 22081:22085 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.136749] binder: 22081:22085 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.136927] binder: 22081:22085 Release 1 refcount change on invalid ref 0 ret -22 [ 827.136940] binder: 22081:22085 transaction failed 29189/-22, size 0-0 line 3119 [ 827.139305] binder: 22080:22088 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.139318] binder: 22080:22088 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.190438] binder: 22096:22102 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.190452] binder: 22096:22102 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.191350] binder: 22096:22102 Release 1 refcount change on invalid ref 0 ret -22 [ 827.191364] binder: 22096:22102 transaction failed 29189/-22, size 0-0 line 3119 [ 827.193703] binder: 22099:22104 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.193715] binder: 22099:22104 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.246276] binder: 22113:22116 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.246289] binder: 22113:22116 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.300547] binder: 22112:22127 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.300560] binder: 22112:22127 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.300673] binder: 22112:22127 Release 1 refcount change on invalid ref 0 ret -22 [ 827.300685] binder: 22112:22127 transaction failed 29189/-22, size 0-0 line 3119 [ 827.326025] binder: 22128:22132 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.326039] binder: 22128:22132 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.362364] binder: 22137:22140 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.362387] binder: 22137:22140 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.362779] binder: 22137:22140 Release 1 refcount change on invalid ref 0 ret -22 [ 827.362798] binder: 22137:22140 transaction failed 29189/-22, size 0-0 line 3119 [ 827.410122] binder: 22144:22151 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.410135] binder: 22144:22151 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.450220] binder: 22156:22159 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.450233] binder: 22156:22159 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.450595] binder: 22156:22159 Release 1 refcount change on invalid ref 0 ret -22 [ 827.450610] binder: 22156:22159 transaction failed 29189/-22, size 0-0 line 3119 [ 827.475641] binder: 22167:22171 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.475654] binder: 22167:22171 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.523998] binder: 22178:22183 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.524012] binder: 22178:22183 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.524594] binder: 22179:22182 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.524649] binder: 22179:22182 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.524779] binder: 22178:22183 Release 1 refcount change on invalid ref 0 ret -22 [ 827.524793] binder: 22178:22183 transaction failed 29189/-22, size 0-0 line 3119 [ 827.602156] binder: 22193:22199 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.602171] binder: 22193:22199 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.603864] binder: 22198:22203 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.603884] binder: 22198:22203 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.604008] binder: 22198:22203 Release 1 refcount change on invalid ref 0 ret -22 [ 827.604022] binder: 22198:22203 transaction failed 29189/-22, size 0-0 line 3119 [ 827.661696] binder: 22211:22218 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.661710] binder: 22211:22218 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.661833] binder: 22211:22218 Release 1 refcount change on invalid ref 0 ret -22 [ 827.661846] binder: 22211:22218 transaction failed 29189/-22, size 0-0 line 3119 [ 827.664752] binder: 22212:22217 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.664764] binder: 22212:22217 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.721561] binder: 22225:22233 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.721578] binder: 22225:22233 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.722308] binder: 22225:22233 Release 1 refcount change on invalid ref 0 ret -22 [ 827.722322] binder: 22225:22233 transaction failed 29189/-22, size 0-0 line 3119 [ 827.735899] binder: 22229:22235 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.735911] binder: 22229:22235 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.789610] binder: 22241:22243 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.789625] binder: 22241:22243 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.790236] binder: 22241:22243 Release 1 refcount change on invalid ref 0 ret -22 [ 827.790250] binder: 22241:22243 transaction failed 29189/-22, size 0-0 line 3119 [ 827.803282] binder: 22246:22253 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.803294] binder: 22246:22253 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.850997] binder: 22256:22265 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.851011] binder: 22256:22265 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.851140] binder: 22256:22265 Release 1 refcount change on invalid ref 0 ret -22 [ 827.851153] binder: 22256:22265 transaction failed 29189/-22, size 0-0 line 3119 [ 827.853507] binder: 22260:22266 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.853529] binder: 22260:22266 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.917650] binder: 22272:22283 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.917663] binder: 22272:22283 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.919004] binder: 22275:22282 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.919017] binder: 22275:22282 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.919068] binder: 22272:22283 Release 1 refcount change on invalid ref 0 ret -22 [ 827.919081] binder: 22272:22283 transaction failed 29189/-22, size 0-0 line 3119 [ 827.992120] binder: 22294:22298 Acquire 1 refcount change on invalid ref 0 ret -22 [ 827.992133] binder: 22294:22298 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 827.992249] binder: 22294:22298 Release 1 refcount change on invalid ref 0 ret -22 [ 827.992261] binder: 22294:22298 transaction failed 29189/-22, size 0-0 line 3119 [ 828.013741] binder: 22293:22302 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.013812] binder: 22293:22302 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.067438] binder: 22306:22316 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.067452] binder: 22306:22316 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.067582] binder: 22306:22316 Release 1 refcount change on invalid ref 0 ret -22 [ 828.067594] binder: 22306:22316 transaction failed 29189/-22, size 0-0 line 3119 [ 828.069858] binder: 22313:22317 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.069879] binder: 22313:22317 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.146807] binder: 22326:22337 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.146820] binder: 22326:22337 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.147099] binder: 22326:22337 Release 1 refcount change on invalid ref 0 ret -22 [ 828.147112] binder: 22326:22337 transaction failed 29189/-22, size 0-0 line 3119 [ 828.150245] binder: 22329:22339 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.150257] binder: 22329:22339 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.232412] binder: 22347:22356 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.232426] binder: 22347:22356 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.232682] binder: 22346:22358 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.232694] binder: 22346:22358 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.232819] binder: 22346:22358 Release 1 refcount change on invalid ref 0 ret -22 [ 828.232832] binder: 22346:22358 transaction failed 29189/-22, size 0-0 line 3119 [ 828.298213] binder: 22366:22372 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.298226] binder: 22366:22372 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.322124] binder: 22375:22380 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.322138] binder: 22375:22380 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.322284] binder: 22375:22380 Release 1 refcount change on invalid ref 0 ret -22 [ 828.322296] binder: 22375:22380 transaction failed 29189/-22, size 0-0 line 3119 [ 828.382055] binder: 22382:22391 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.382067] binder: 22382:22391 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.388136] binder: 22389:22395 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.388156] binder: 22389:22395 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.399997] binder: 22389:22395 Release 1 refcount change on invalid ref 0 ret -22 [ 828.400014] binder: 22389:22395 transaction failed 29189/-22, size 0-0 line 3119 [ 828.442229] binder: 22400:22404 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.442242] binder: 22400:22404 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.461582] binder: 22409:22412 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.461594] binder: 22409:22412 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.462444] binder: 22409:22412 Release 1 refcount change on invalid ref 0 ret -22 [ 828.462457] binder: 22409:22412 transaction failed 29189/-22, size 0-0 line 3119 [ 828.521396] binder: 22418:22424 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.521411] binder: 22418:22424 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.521670] binder: 22418:22424 Release 1 refcount change on invalid ref 0 ret -22 [ 828.521684] binder: 22418:22424 transaction failed 29189/-22, size 0-0 line 3119 [ 828.534011] binder: 22419:22427 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.534024] binder: 22419:22427 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.603745] binder: 22442:22446 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.603761] binder: 22442:22446 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.603791] binder: 22433:22445 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.603801] binder: 22433:22445 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.604181] binder: 22433:22445 Release 1 refcount change on invalid ref 0 ret -22 [ 828.604194] binder: 22433:22445 transaction failed 29189/-22, size 0-0 line 3119 [ 828.681101] binder: 22451:22462 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.681114] binder: 22451:22462 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.689336] binder: 22459:22466 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.689349] binder: 22459:22466 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.690099] binder: 22459:22466 Release 1 refcount change on invalid ref 0 ret -22 [ 828.690112] binder: 22459:22466 transaction failed 29189/-22, size 0-0 line 3119 [ 828.758361] binder: 22472:22482 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.758436] binder: 22472:22482 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.759817] binder: 22475:22481 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.759830] binder: 22475:22481 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.759965] binder: 22475:22481 Release 1 refcount change on invalid ref 0 ret -22 [ 828.759979] binder: 22475:22481 transaction failed 29189/-22, size 0-0 line 3119 [ 828.796233] binder: 22486:22491 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.796246] binder: 22486:22491 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.796374] binder: 22486:22491 Release 1 refcount change on invalid ref 0 ret -22 [ 828.796387] binder: 22486:22491 transaction failed 29189/-22, size 0-0 line 3119 [ 828.800453] binder: 22485:22492 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.800466] binder: 22485:22492 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.854236] binder: 22497:22501 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.854250] binder: 22497:22501 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.854413] binder: 22497:22501 Release 1 refcount change on invalid ref 0 ret -22 [ 828.854427] binder: 22497:22501 transaction failed 29189/-22, size 0-0 line 3119 [ 828.879204] binder: 22499:22504 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.879217] binder: 22499:22504 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.912050] binder: 22512:22521 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.912063] binder: 22512:22521 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.912294] binder: 22512:22521 Release 1 refcount change on invalid ref 0 ret -22 [ 828.912306] binder: 22512:22521 transaction failed 29189/-22, size 0-0 line 3119 [ 828.936345] binder: 22516:22522 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.936413] binder: 22516:22522 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.981869] binder: 22529:22536 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.981891] binder: 22529:22536 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.982016] binder: 22529:22536 Release 1 refcount change on invalid ref 0 ret -22 [ 828.982030] binder: 22529:22536 transaction failed 29189/-22, size 0-0 line 3119 [ 828.992250] binder: 22532:22537 Acquire 1 refcount change on invalid ref 0 ret -22 [ 828.992263] binder: 22532:22537 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.058620] binder: 22542:22550 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.058634] binder: 22542:22550 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.058754] binder: 22542:22550 Release 1 refcount change on invalid ref 0 ret -22 [ 829.058767] binder: 22542:22550 transaction failed 29189/-22, size 0-0 line 3119 [ 829.092905] binder: 22549:22557 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.092918] binder: 22549:22557 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.110458] binder: 22566:22567 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.110472] binder: 22566:22567 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.110599] binder: 22566:22567 Release 1 refcount change on invalid ref 0 ret -22 [ 829.110613] binder: 22566:22567 transaction failed 29189/-22, size 0-0 line 3119 [ 829.178775] binder: 22573:22583 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.178788] binder: 22573:22583 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.192546] binder: 22574:22584 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.192559] binder: 22574:22584 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.192684] binder: 22574:22584 Release 1 refcount change on invalid ref 0 ret -22 [ 829.192698] binder: 22574:22584 transaction failed 29189/-22, size 0-0 line 3119 [ 829.211191] binder: 22587:22589 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.211205] binder: 22587:22589 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.268051] binder: 22598:22601 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.268064] binder: 22598:22601 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.275693] binder: 22600:22606 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.275706] binder: 22600:22606 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.276816] binder: 22600:22606 Release 1 refcount change on invalid ref 0 ret -22 [ 829.276830] binder: 22600:22606 transaction failed 29189/-22, size 0-0 line 3119 [ 829.332802] binder: 22612:22621 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.332816] binder: 22612:22621 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.357783] binder: 22617:22622 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.357796] binder: 22617:22622 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.357915] binder: 22617:22622 Release 1 refcount change on invalid ref 0 ret -22 [ 829.357928] binder: 22617:22622 transaction failed 29189/-22, size 0-0 line 3119 [ 829.384198] binder: 22628:22632 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.384212] binder: 22628:22632 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.424695] binder: 22635:22643 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.424710] binder: 22635:22643 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.424888] binder: 22635:22643 Release 1 refcount change on invalid ref 0 ret -22 [ 829.424901] binder: 22635:22643 transaction failed 29189/-22, size 0-0 line 3119 [ 829.440474] binder: 22640:22647 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.440487] binder: 22640:22647 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.496166] binder: 22653:22660 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.496180] binder: 22653:22660 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.498067] binder: 22651:22659 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.498079] binder: 22651:22659 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.498324] binder: 22651:22659 Release 1 refcount change on invalid ref 0 ret -22 [ 829.498337] binder: 22651:22659 transaction failed 29189/-22, size 0-0 line 3119 [ 829.551568] binder: 22672:22674 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.551585] binder: 22672:22674 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.552531] binder: 22672:22674 Release 1 refcount change on invalid ref 0 ret -22 [ 829.552548] binder: 22672:22674 transaction failed 29189/-22, size 0-0 line 3119 [ 829.559655] binder: 22668:22673 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.559669] binder: 22668:22673 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.612932] binder: 22680:22685 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.612945] binder: 22680:22685 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.634641] binder: 22686:22693 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.634654] binder: 22686:22693 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.634781] binder: 22686:22693 Release 1 refcount change on invalid ref 0 ret -22 [ 829.634795] binder: 22686:22693 transaction failed 29189/-22, size 0-0 line 3119 [ 829.686427] binder: 22696:22698 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.686440] binder: 22696:22698 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.716485] binder: 22708:22714 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.716499] binder: 22708:22714 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.716627] binder: 22708:22714 Release 1 refcount change on invalid ref 0 ret -22 [ 829.716641] binder: 22708:22714 transaction failed 29189/-22, size 0-0 line 3119 [ 829.744463] binder: 22716:22718 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.744476] binder: 22716:22718 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.774493] binder: 22723:22726 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.774510] binder: 22723:22726 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.774692] binder: 22723:22726 Release 1 refcount change on invalid ref 0 ret -22 [ 829.774708] binder: 22723:22726 transaction failed 29189/-22, size 0-0 line 3119 [ 829.804793] binder: 22730:22731 Acquire 1 refcount change on invalid ref 0 ret -22 [ 829.804810] binder: 22730:22731 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.845233] binder: 22736:22741 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 829.845247] binder: 22736:22741 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.845889] binder: 22736:22741 Release 1 refcount change on invalid ref 0 ret -22 [ 829.845903] binder: 22736:22741 transaction failed 29189/-22, size 0-0 line 3119 [ 841.473868] binder: undelivered TRANSACTION_ERROR: 29189 [ 841.479469] binder: undelivered TRANSACTION_ERROR: 29189 [ 841.485056] binder: undelivered TRANSACTION_ERROR: 29189 [ 841.490677] binder: undelivered TRANSACTION_ERROR: 29189 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.502384] binder: undelivered TRANSACTION_ERROR: 29189 [ 841.517808] binder: 22749:22755 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 841.517822] binder: 22749:22755 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 841.518263] binder: 22749:22755 Release 1 refcount change on invalid ref 0 ret -22 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 841.518278] binder: 22749:22755 transaction failed 29189/-22, size 0-0 line 3119 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 841.518612] binder: 22747:22756 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 841.518625] binder: 22747:22756 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 841.556315] binder: 22760:22766 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 841.556329] binder: 22760:22766 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.556474] binder: 22760:22766 Release 1 refcount change on invalid ref 0 ret -22 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 841.556487] binder: 22760:22766 transaction failed 29189/-22, size 0-0 line 3119 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 841.583174] binder: 22765:22771 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:14 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:14 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 841.583186] binder: 22765:22771 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.638943] binder: 22782:22786 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.638955] binder: 22782:22786 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.642537] binder: 22777:22781 Acquire 1 refcount change on invalid ref 0 ret -22 [ 841.642548] binder: 22777:22781 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 841.642669] binder: 22777:22781 Release 1 refcount change on invalid ref 0 ret -22 [ 841.642687] binder: 22777:22781 transaction failed 29189/-22, size 0-0 line 3119 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.693696] binder: 22793:22798 Acquire 1 refcount change on invalid ref 0 ret -22 [ 841.693709] binder: 22793:22798 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 841.693831] binder: 22793:22798 Release 1 refcount change on invalid ref 0 ret -22 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 841.693844] binder: 22793:22798 transaction failed 29189/-22, size 0-0 line 3119 [ 841.727473] binder: 22797:22804 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 841.727488] binder: 22797:22804 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 841.757863] binder: 22811:22816 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.757876] binder: 22811:22816 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 841.758548] binder: 22811:22816 Release 1 refcount change on invalid ref 0 ret -22 [ 841.758560] binder: 22811:22816 transaction failed 29189/-22, size 0-0 line 3119 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.786467] binder: 22819:22822 Acquire 1 refcount change on invalid ref 0 ret -22 [ 841.786480] binder: 22819:22822 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 841.823722] binder: 22827:22831 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.823735] binder: 22827:22831 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 841.823868] binder: 22827:22831 Release 1 refcount change on invalid ref 0 ret -22 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 841.823889] binder: 22827:22831 transaction failed 29189/-22, size 0-0 line 3119 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 841.861677] binder: 22836:22842 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:15 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:15 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.861689] binder: 22836:22842 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 841.893569] binder: 22846:22851 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.893582] binder: 22846:22851 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 841.897371] binder: 22846:22851 Release 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.897397] binder: 22846:22851 transaction failed 29189/-22, size 0-0 line 3119 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 841.936118] binder: 22857:22861 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.936133] binder: 22857:22861 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 841.956569] binder: 22862:22867 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 841.956582] binder: 22862:22867 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 841.956710] binder: 22862:22867 Release 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.956723] binder: 22862:22867 transaction failed 29189/-22, size 0-0 line 3119 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.984202] binder: 22872:22876 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 841.984215] binder: 22872:22876 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 841.984340] binder: 22872:22876 Release 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 841.984353] binder: 22872:22876 transaction failed 29189/-22, size 0-0 line 3119 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.991666] binder: 22873:22878 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 841.991678] binder: 22873:22878 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.044332] binder: 22886:22889 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.044344] binder: 22886:22889 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.056642] binder: 22892:22896 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.056654] binder: 22892:22896 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.056773] binder: 22892:22896 Release 1 refcount change on invalid ref 0 ret -22 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:16 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.056786] binder: 22892:22896 transaction failed 29189/-22, size 0-0 line 3119 14:20:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:16 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 842.092799] binder: 22900:22902 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.092812] binder: 22900:22902 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.133620] binder: 22912:22918 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.133633] binder: 22912:22918 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.139605] binder: 22909:22919 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.139617] binder: 22909:22919 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.139730] binder: 22909:22919 Release 1 refcount change on invalid ref 0 ret -22 [ 842.139745] binder: 22909:22919 transaction failed 29189/-22, size 0-0 line 3119 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.191781] binder: 22924:22927 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.191795] binder: 22924:22927 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.228126] binder: 22930:22935 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.228141] binder: 22930:22935 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.228521] binder: 22930:22935 Release 1 refcount change on invalid ref 0 ret -22 [ 842.228534] binder: 22930:22935 transaction failed 29189/-22, size 0-0 line 3119 [ 842.250521] binder: 22940:22945 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.250534] binder: 22940:22945 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.287977] binder: 22947:22951 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.287991] binder: 22947:22951 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.288199] binder: 22947:22951 Release 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.288212] binder: 22947:22951 transaction failed 29189/-22, size 0-0 line 3119 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.322038] binder: 22959:22963 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.322051] binder: 22959:22963 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.371660] binder: 22969:22971 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.371673] binder: 22969:22971 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.375194] binder: 22966:22972 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.375206] binder: 22966:22972 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.375316] binder: 22966:22972 Release 1 refcount change on invalid ref 0 ret -22 [ 842.375329] binder: 22966:22972 transaction failed 29189/-22, size 0-0 line 3119 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.412456] binder: 22986:22988 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.412467] binder: 22986:22988 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.412567] binder: 22986:22988 Release 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.412578] binder: 22986:22988 transaction failed 29189/-22, size 0-0 line 3119 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 842.430777] binder: 22983:22995 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:17 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:17 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 842.430791] binder: 22983:22995 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.476269] binder: 22994:23001 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.476283] binder: 22994:23001 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.476394] binder: 22994:23001 Release 1 refcount change on invalid ref 0 ret -22 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.476407] binder: 22994:23001 transaction failed 29189/-22, size 0-0 line 3119 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.494623] binder: 23000:23009 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.494639] binder: 23000:23009 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.528746] binder: 23012:23013 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.528759] binder: 23012:23013 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.528870] binder: 23012:23013 Release 1 refcount change on invalid ref 0 ret -22 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.528882] binder: 23012:23013 transaction failed 29189/-22, size 0-0 line 3119 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 842.549729] binder: 23017:23022 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 842.549742] binder: 23017:23022 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.593610] binder: 23026:23032 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.593622] binder: 23026:23032 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.593734] binder: 23026:23032 Release 1 refcount change on invalid ref 0 ret -22 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.593750] binder: 23026:23032 transaction failed 29189/-22, size 0-0 line 3119 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.597489] binder: 23034:23039 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.597502] binder: 23034:23039 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:18 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:18 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.654633] binder: 23048:23049 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 842.654646] binder: 23048:23049 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.698063] binder: 23056:23059 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.698076] binder: 23056:23059 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.698835] binder: 23056:23059 Release 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.698848] binder: 23056:23059 transaction failed 29189/-22, size 0-0 line 3119 [ 842.730312] binder: 23062:23065 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.730325] binder: 23062:23065 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 842.747732] binder: 23070:23076 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.747745] binder: 23070:23076 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.747866] binder: 23070:23076 Release 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.747886] binder: 23070:23076 transaction failed 29189/-22, size 0-0 line 3119 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 842.791423] binder: 23077:23079 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.791435] binder: 23077:23079 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 842.822299] binder: 23084:23092 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.822312] binder: 23084:23092 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.822447] binder: 23084:23092 Release 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.822460] binder: 23084:23092 transaction failed 29189/-22, size 0-0 line 3119 [ 842.854776] binder: 23095:23099 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.854790] binder: 23095:23099 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.880643] binder: 23106:23110 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.880657] binder: 23106:23110 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.880786] binder: 23106:23110 Release 1 refcount change on invalid ref 0 ret -22 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 842.880799] binder: 23106:23110 transaction failed 29189/-22, size 0-0 line 3119 14:20:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:19 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:19 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 842.888522] binder: 23108:23112 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.888534] binder: 23108:23112 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.945033] binder: 23119:23121 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 842.945047] binder: 23119:23121 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 842.945343] binder: 23119:23121 Release 1 refcount change on invalid ref 0 ret -22 [ 842.945356] binder: 23119:23121 transaction failed 29189/-22, size 0-0 line 3119 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 842.965348] binder: 23124:23130 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.965360] binder: 23124:23130 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 842.993471] binder: 23134:23140 Acquire 1 refcount change on invalid ref 0 ret -22 [ 842.993484] binder: 23134:23140 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.005970] binder: 23134:23140 Release 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 843.005984] binder: 23134:23140 transaction failed 29189/-22, size 0-0 line 3119 [ 843.018184] binder: 23139:23147 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.018197] binder: 23139:23147 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.067745] binder: 23156:23162 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.067759] binder: 23156:23162 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.067896] binder: 23156:23162 Release 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.067908] binder: 23156:23162 transaction failed 29189/-22, size 0-0 line 3119 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.074599] binder: 23159:23163 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.074611] binder: 23159:23163 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.140948] binder: 23166:23176 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 843.140961] binder: 23166:23176 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.146651] binder: 23172:23180 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:20 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:20 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.146664] binder: 23172:23180 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.146789] binder: 23172:23180 Release 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.146802] binder: 23172:23180 transaction failed 29189/-22, size 0-0 line 3119 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.198584] binder: 23188:23195 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.198598] binder: 23188:23195 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.221305] binder: 23192:23198 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.221319] binder: 23192:23198 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.221435] binder: 23192:23198 Release 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.221448] binder: 23192:23198 transaction failed 29189/-22, size 0-0 line 3119 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.244920] binder: 23201:23207 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.244933] binder: 23201:23207 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.259332] binder: 23206:23211 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.259344] binder: 23206:23211 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.259473] binder: 23206:23211 Release 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.259486] binder: 23206:23211 transaction failed 29189/-22, size 0-0 line 3119 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.302427] binder: 23220:23224 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.302443] binder: 23220:23224 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.303281] binder: 23217:23222 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 843.303294] binder: 23217:23222 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.303609] binder: 23217:23222 Release 1 refcount change on invalid ref 0 ret -22 14:20:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:21 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:21 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:21 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.303623] binder: 23217:23222 transaction failed 29189/-22, size 0-0 line 3119 [ 843.344650] binder: 23234:23238 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.344664] binder: 23234:23238 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.344786] binder: 23234:23238 Release 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.344800] binder: 23234:23238 transaction failed 29189/-22, size 0-0 line 3119 [ 843.361810] binder: 23231:23235 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.361822] binder: 23231:23235 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.406493] binder: 23244:23250 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.406507] binder: 23244:23250 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.406646] binder: 23244:23250 Release 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.406845] binder: 23244:23250 transaction failed 29189/-22, size 0-0 line 3119 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.415096] binder: 23248:23252 Acquire 1 refcount change on invalid ref 0 ret -22 [ 843.415110] binder: 23248:23252 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.453652] binder: 23261:23263 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.453665] binder: 23261:23263 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.488991] binder: 23269:23275 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.489003] binder: 23269:23275 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.489132] binder: 23269:23275 Release 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 843.489145] binder: 23269:23275 transaction failed 29189/-22, size 0-0 line 3119 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.521215] binder: 23281:23284 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.521228] binder: 23281:23284 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.521329] binder: 23281:23284 Release 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:22 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:22 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.521341] binder: 23281:23284 transaction failed 29189/-22, size 0-0 line 3119 [ 843.524900] binder: 23277:23280 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:22 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.524913] binder: 23277:23280 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.569459] binder: 23286:23292 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.569473] binder: 23286:23292 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.570045] binder: 23286:23292 Release 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.570057] binder: 23286:23292 transaction failed 29189/-22, size 0-0 line 3119 [ 843.603922] binder: 23295:23299 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.603936] binder: 23295:23299 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.644858] binder: 23307:23310 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.644872] binder: 23307:23310 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.644997] binder: 23307:23310 Release 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.645010] binder: 23307:23310 transaction failed 29189/-22, size 0-0 line 3119 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 843.667501] binder: 23314:23318 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.667679] binder: 23314:23318 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.687203] binder: 23322:23326 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.687214] binder: 23322:23326 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 843.687333] binder: 23322:23326 Release 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 843.687345] binder: 23322:23326 transaction failed 29189/-22, size 0-0 line 3119 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.724856] binder: 23330:23331 Acquire 1 refcount change on invalid ref 0 ret -22 [ 843.724869] binder: 23330:23331 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:23 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:23 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.725683] binder: 23330:23331 Release 1 refcount change on invalid ref 0 ret -22 14:20:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:23 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:24 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.725703] binder: 23330:23331 transaction failed 29189/-22, size 0-0 line 3119 [ 843.742568] binder: 23333:23336 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:24 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:24 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:24 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 843.742581] binder: 23333:23336 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.792059] binder: 23343:23351 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:24 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:24 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:24 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 843.792071] binder: 23343:23351 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:24 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:24 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.792182] binder: 23343:23351 Release 1 refcount change on invalid ref 0 ret -22 [ 843.792195] binder: 23343:23351 transaction failed 29189/-22, size 0-0 line 3119 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:24 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:24 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.807968] binder: 23353:23355 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:24 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 843.807980] binder: 23353:23355 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.835579] binder: 23363:23366 Acquire 1 refcount change on invalid ref 0 ret -22 [ 843.835591] binder: 23363:23366 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:24 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:24 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:24 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 843.859735] binder: 23367:23369 Acquire 1 refcount change on invalid ref 0 ret -22 [ 843.859748] binder: 23367:23369 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:24 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 843.859913] binder: 23367:23369 Release 1 refcount change on invalid ref 0 ret -22 [ 843.859926] binder: 23367:23369 transaction failed 29189/-22, size 0-0 line 3119 [ 843.911191] binder: 23376:23383 Acquire 1 refcount change on invalid ref 0 ret -22 [ 843.911206] binder: 23376:23383 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.915504] binder: 23381:23384 Acquire 1 refcount change on invalid ref 0 ret -22 [ 843.915517] binder: 23381:23384 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.915630] binder: 23381:23384 Release 1 refcount change on invalid ref 0 ret -22 [ 843.915643] binder: 23381:23384 transaction failed 29189/-22, size 0-0 line 3119 [ 843.943084] binder: 23391:23397 Acquire 1 refcount change on invalid ref 0 ret -22 [ 843.943104] binder: 23391:23397 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.994634] binder: 23400:23404 Acquire 1 refcount change on invalid ref 0 ret -22 [ 843.994648] binder: 23400:23404 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.994893] binder: 23400:23404 Release 1 refcount change on invalid ref 0 ret -22 [ 843.994906] binder: 23400:23404 transaction failed 29189/-22, size 0-0 line 3119 [ 844.003359] binder: 23403:23410 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.004575] binder: 23403:23410 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.038513] binder: 23418:23420 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.038527] binder: 23418:23420 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.093121] binder: 23417:23428 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.093134] binder: 23417:23428 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.093328] binder: 23417:23428 Release 1 refcount change on invalid ref 0 ret -22 [ 844.093340] binder: 23417:23428 transaction failed 29189/-22, size 0-0 line 3119 [ 844.112577] binder: 23435:23440 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.112596] binder: 23435:23440 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.142661] binder: 23439:23446 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.142674] binder: 23439:23446 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.142803] binder: 23439:23446 Release 1 refcount change on invalid ref 0 ret -22 [ 844.142815] binder: 23439:23446 transaction failed 29189/-22, size 0-0 line 3119 [ 844.183279] binder: 23450:23457 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.183293] binder: 23450:23457 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.203488] binder: 23456:23462 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.203501] binder: 23456:23462 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.203678] binder: 23456:23462 Release 1 refcount change on invalid ref 0 ret -22 [ 844.203691] binder: 23456:23462 transaction failed 29189/-22, size 0-0 line 3119 [ 844.249536] binder: 23470:23471 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.249550] binder: 23470:23471 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.249697] binder: 23470:23471 Release 1 refcount change on invalid ref 0 ret -22 [ 844.249710] binder: 23470:23471 transaction failed 29189/-22, size 0-0 line 3119 [ 844.263996] binder: 23464:23472 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.264010] binder: 23464:23472 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.305184] binder: 23481:23488 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.305198] binder: 23481:23488 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.316287] binder: 23484:23489 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.316301] binder: 23484:23489 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.316988] binder: 23484:23489 Release 1 refcount change on invalid ref 0 ret -22 [ 844.317002] binder: 23484:23489 transaction failed 29189/-22, size 0-0 line 3119 [ 844.438310] binder: 23499:23501 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.438324] binder: 23499:23501 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.443623] binder: 23499:23501 Release 1 refcount change on invalid ref 0 ret -22 [ 844.443636] binder: 23499:23501 transaction failed 29189/-22, size 0-0 line 3119 [ 844.482399] binder: 23504:23505 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.482412] binder: 23504:23505 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.513362] binder: 23508:23514 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.513376] binder: 23508:23514 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.513496] binder: 23508:23514 Release 1 refcount change on invalid ref 0 ret -22 [ 844.513509] binder: 23508:23514 transaction failed 29189/-22, size 0-0 line 3119 [ 844.572600] binder: 23522:23531 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.572614] binder: 23522:23531 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.590487] binder: 23536:23538 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.590501] binder: 23536:23538 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.590627] binder: 23536:23538 Release 1 refcount change on invalid ref 0 ret -22 [ 844.590641] binder: 23536:23538 transaction failed 29189/-22, size 0-0 line 3119 [ 844.625658] binder: 23542:23545 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.625678] binder: 23542:23545 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.640681] binder: 23549:23552 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.640695] binder: 23549:23552 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.640818] binder: 23549:23552 Release 1 refcount change on invalid ref 0 ret -22 [ 844.640831] binder: 23549:23552 transaction failed 29189/-22, size 0-0 line 3119 [ 844.675794] binder: 23556:23557 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.675807] binder: 23556:23557 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.713044] binder: 23559:23571 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.713058] binder: 23559:23571 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.713869] binder: 23559:23571 Release 1 refcount change on invalid ref 0 ret -22 [ 844.713881] binder: 23559:23571 transaction failed 29189/-22, size 0-0 line 3119 [ 844.739204] binder: 23566:23573 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.739219] binder: 23566:23573 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.776147] binder: 23582:23583 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.776160] binder: 23582:23583 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.776357] binder: 23582:23583 Release 1 refcount change on invalid ref 0 ret -22 [ 844.776370] binder: 23582:23583 transaction failed 29189/-22, size 0-0 line 3119 [ 844.809882] binder: 23586:23595 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.809895] binder: 23586:23595 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.821426] binder: 23592:23599 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.821438] binder: 23592:23599 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.822200] binder: 23592:23599 Release 1 refcount change on invalid ref 0 ret -22 [ 844.822213] binder: 23592:23599 transaction failed 29189/-22, size 0-0 line 3119 [ 844.868168] binder: 23601:23609 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.868182] binder: 23601:23609 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.908732] binder: 23607:23621 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.908746] binder: 23607:23621 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.908872] binder: 23607:23621 Release 1 refcount change on invalid ref 0 ret -22 [ 844.908896] binder: 23607:23621 transaction failed 29189/-22, size 0-0 line 3119 [ 844.930649] binder: 23616:23623 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.930662] binder: 23616:23623 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.967160] binder: 23627:23636 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.967172] binder: 23627:23636 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.967456] binder: 23627:23636 Release 1 refcount change on invalid ref 0 ret -22 [ 844.967470] binder: 23627:23636 transaction failed 29189/-22, size 0-0 line 3119 [ 844.985056] binder: 23631:23639 Acquire 1 refcount change on invalid ref 0 ret -22 [ 844.985068] binder: 23631:23639 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.022521] binder: 23643:23652 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.022534] binder: 23643:23652 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.025719] binder: 23643:23652 Release 1 refcount change on invalid ref 0 ret -22 [ 845.025732] binder: 23643:23652 transaction failed 29189/-22, size 0-0 line 3119 [ 845.053339] binder: 23647:23656 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.053353] binder: 23647:23656 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.089609] binder: 23659:23666 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.089623] binder: 23659:23666 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.089748] binder: 23659:23666 Release 1 refcount change on invalid ref 0 ret -22 [ 845.089761] binder: 23659:23666 transaction failed 29189/-22, size 0-0 line 3119 [ 845.136493] binder: 23668:23675 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.136506] binder: 23668:23675 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.161257] binder: 23677:23684 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.161269] binder: 23677:23684 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.161406] binder: 23677:23684 Release 1 refcount change on invalid ref 0 ret -22 [ 845.161419] binder: 23677:23684 transaction failed 29189/-22, size 0-0 line 3119 [ 845.201135] binder: 23688:23693 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.201149] binder: 23688:23693 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.217652] binder: 23691:23698 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.217674] binder: 23691:23698 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.219216] binder: 23691:23698 Release 1 refcount change on invalid ref 0 ret -22 [ 845.219229] binder: 23691:23698 transaction failed 29189/-22, size 0-0 line 3119 [ 845.266198] binder: 23704:23710 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.266211] binder: 23704:23710 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.272224] binder: 23708:23716 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.272236] binder: 23708:23716 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.272357] binder: 23708:23716 Release 1 refcount change on invalid ref 0 ret -22 [ 845.272371] binder: 23708:23716 transaction failed 29189/-22, size 0-0 line 3119 [ 845.325684] binder: 23721:23723 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.325697] binder: 23721:23723 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.348135] binder: 23726:23733 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.348148] binder: 23726:23733 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.348832] binder: 23726:23733 Release 1 refcount change on invalid ref 0 ret -22 [ 845.348846] binder: 23726:23733 transaction failed 29189/-22, size 0-0 line 3119 [ 845.385948] binder: 23735:23739 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.385961] binder: 23735:23739 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.417558] binder: 23746:23749 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.417571] binder: 23746:23749 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.417690] binder: 23746:23749 Release 1 refcount change on invalid ref 0 ret -22 [ 845.417702] binder: 23746:23749 transaction failed 29189/-22, size 0-0 line 3119 [ 845.442303] binder: 23750:23756 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.442317] binder: 23750:23756 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.481645] binder: 23759:23763 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.481658] binder: 23759:23763 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.481792] binder: 23759:23763 Release 1 refcount change on invalid ref 0 ret -22 [ 845.481806] binder: 23759:23763 transaction failed 29189/-22, size 0-0 line 3119 [ 845.495325] binder: 23766:23772 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.495337] binder: 23766:23772 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.556482] binder: 23778:23787 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.556494] binder: 23778:23787 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.561749] binder: 23776:23785 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.561761] binder: 23776:23785 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.561884] binder: 23776:23785 Release 1 refcount change on invalid ref 0 ret -22 [ 845.561898] binder: 23776:23785 transaction failed 29189/-22, size 0-0 line 3119 [ 845.617354] binder: 23797:23801 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.617367] binder: 23797:23801 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.617503] binder: 23797:23801 Release 1 refcount change on invalid ref 0 ret -22 [ 845.617517] binder: 23797:23801 transaction failed 29189/-22, size 0-0 line 3119 [ 845.631032] binder: 23802:23806 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.631045] binder: 23802:23806 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.681372] binder: 23811:23818 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.681394] binder: 23811:23818 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.681506] binder: 23811:23818 Release 1 refcount change on invalid ref 0 ret -22 [ 845.681519] binder: 23811:23818 transaction failed 29189/-22, size 0-0 line 3119 [ 845.695848] binder: 23817:23820 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.695861] binder: 23817:23820 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.733538] binder: 23828:23831 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.733551] binder: 23828:23831 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.733676] binder: 23828:23831 Release 1 refcount change on invalid ref 0 ret -22 [ 845.733688] binder: 23828:23831 transaction failed 29189/-22, size 0-0 line 3119 [ 845.753231] binder: 23835:23838 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.753245] binder: 23835:23838 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.763218] binder: 23840:23841 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.763231] binder: 23840:23841 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.763612] binder: 23840:23841 Release 1 refcount change on invalid ref 0 ret -22 [ 845.763627] binder: 23840:23841 transaction failed 29189/-22, size 0-0 line 3119 [ 845.795533] binder: 23843:23847 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.795547] binder: 23843:23847 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.823793] binder: 23852:23857 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.823805] binder: 23852:23857 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.824210] binder: 23852:23857 Release 1 refcount change on invalid ref 0 ret -22 [ 845.824223] binder: 23852:23857 transaction failed 29189/-22, size 0-0 line 3119 [ 845.860005] binder: 23859:23862 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.860020] binder: 23859:23862 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.889225] binder: 23867:23872 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.889237] binder: 23867:23872 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.889349] binder: 23867:23872 Release 1 refcount change on invalid ref 0 ret -22 [ 845.889362] binder: 23867:23872 transaction failed 29189/-22, size 0-0 line 3119 [ 845.933244] binder: 23877:23880 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.933257] binder: 23877:23880 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.963838] binder: 23886:23890 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.963851] binder: 23886:23890 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.965130] binder: 23886:23890 Release 1 refcount change on invalid ref 0 ret -22 [ 845.965143] binder: 23886:23890 transaction failed 29189/-22, size 0-0 line 3119 [ 845.996444] binder: 23893:23897 Acquire 1 refcount change on invalid ref 0 ret -22 [ 845.996456] binder: 23893:23897 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.021573] binder: 23899:23908 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.021586] binder: 23899:23908 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.021753] binder: 23899:23908 Release 1 refcount change on invalid ref 0 ret -22 [ 846.021766] binder: 23899:23908 transaction failed 29189/-22, size 0-0 line 3119 [ 846.052367] binder: 23909:23913 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.052389] binder: 23909:23913 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.114786] binder: 23924:23929 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.114799] binder: 23924:23929 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.114933] binder: 23924:23929 Release 1 refcount change on invalid ref 0 ret -22 [ 846.114946] binder: 23924:23929 transaction failed 29189/-22, size 0-0 line 3119 [ 846.137844] binder: 23927:23930 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.137857] binder: 23927:23930 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.139743] binder: 23934:23938 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.139755] binder: 23934:23938 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.140963] binder: 23934:23938 Release 1 refcount change on invalid ref 0 ret -22 [ 846.140976] binder: 23934:23938 transaction failed 29189/-22, size 0-0 line 3119 [ 846.192670] binder: 23945:23947 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.192683] binder: 23945:23947 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.193419] binder: 23945:23947 Release 1 refcount change on invalid ref 0 ret -22 [ 846.193433] binder: 23945:23947 transaction failed 29189/-22, size 0-0 line 3119 [ 846.195727] binder: 23946:23951 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.195739] binder: 23946:23951 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.246157] binder: 23958:23963 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.246171] binder: 23958:23963 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.246287] binder: 23958:23963 Release 1 refcount change on invalid ref 0 ret -22 [ 846.246300] binder: 23958:23963 transaction failed 29189/-22, size 0-0 line 3119 [ 846.248049] binder: 23959:23964 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.248061] binder: 23959:23964 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.311094] binder: 23977:23980 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.311114] binder: 23977:23980 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.312703] binder: 23976:23982 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.312715] binder: 23976:23982 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.312835] binder: 23976:23982 Release 1 refcount change on invalid ref 0 ret -22 [ 846.312847] binder: 23976:23982 transaction failed 29189/-22, size 0-0 line 3119 [ 846.368180] binder: 23992:23994 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.368192] binder: 23992:23994 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.371903] binder: 23992:23994 Release 1 refcount change on invalid ref 0 ret -22 [ 846.371917] binder: 23992:23994 transaction failed 29189/-22, size 0-0 line 3119 [ 846.402781] binder: 23990:24001 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.402794] binder: 23990:24001 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.429475] binder: 24005:24007 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.429488] binder: 24005:24007 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.429597] binder: 24005:24007 Release 1 refcount change on invalid ref 0 ret -22 [ 846.429610] binder: 24005:24007 transaction failed 29189/-22, size 0-0 line 3119 [ 846.468462] binder: 24012:24014 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.468475] binder: 24012:24014 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.482996] binder: 24017:24020 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.483008] binder: 24017:24020 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.483501] binder: 24017:24020 Release 1 refcount change on invalid ref 0 ret -22 [ 846.483515] binder: 24017:24020 transaction failed 29189/-22, size 0-0 line 3119 [ 846.524016] binder: 24029:24031 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.524030] binder: 24029:24031 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.533157] binder: 24032:24036 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.533171] binder: 24032:24036 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.533294] binder: 24032:24036 Release 1 refcount change on invalid ref 0 ret -22 [ 846.533307] binder: 24032:24036 transaction failed 29189/-22, size 0-0 line 3119 [ 846.578566] binder: 24045:24049 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.578579] binder: 24045:24049 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.579145] binder: 24045:24049 Release 1 refcount change on invalid ref 0 ret -22 [ 846.579159] binder: 24045:24049 transaction failed 29189/-22, size 0-0 line 3119 [ 846.585219] binder: 24043:24051 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.585232] binder: 24043:24051 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.649470] binder: 24059:24063 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.649482] binder: 24059:24063 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.650123] binder: 24059:24063 Release 1 refcount change on invalid ref 0 ret -22 [ 846.650137] binder: 24059:24063 transaction failed 29189/-22, size 0-0 line 3119 [ 846.671355] binder: 24061:24065 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.671370] binder: 24061:24065 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.713432] binder: 24072:24078 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.713446] binder: 24072:24078 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.713560] binder: 24072:24078 Release 1 refcount change on invalid ref 0 ret -22 [ 846.713573] binder: 24072:24078 transaction failed 29189/-22, size 0-0 line 3119 [ 846.741938] binder: 24085:24087 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.741949] binder: 24085:24087 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.790641] binder: 24089:24097 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.790654] binder: 24089:24097 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.790767] binder: 24089:24097 Release 1 refcount change on invalid ref 0 ret -22 [ 846.790779] binder: 24089:24097 transaction failed 29189/-22, size 0-0 line 3119 [ 846.801712] binder: 24096:24101 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.801724] binder: 24096:24101 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.839933] binder: 24109:24111 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.839946] binder: 24109:24111 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.840972] binder: 24109:24111 Release 1 refcount change on invalid ref 0 ret -22 [ 846.840985] binder: 24109:24111 transaction failed 29189/-22, size 0-0 line 3119 [ 846.863055] binder: 24113:24118 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.863068] binder: 24113:24118 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.886208] binder: 24120:24125 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.886221] binder: 24120:24125 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.886335] binder: 24120:24125 Release 1 refcount change on invalid ref 0 ret -22 [ 846.886362] binder: 24120:24125 transaction failed 29189/-22, size 0-0 line 3119 [ 846.928724] binder: 24130:24137 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.928736] binder: 24130:24137 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.928857] binder: 24130:24137 Release 1 refcount change on invalid ref 0 ret -22 [ 846.928870] binder: 24130:24137 transaction failed 29189/-22, size 0-0 line 3119 [ 846.933987] binder: 24131:24139 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.933999] binder: 24131:24139 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.994012] binder: 24144:24154 Acquire 1 refcount change on invalid ref 0 ret -22 [ 846.994025] binder: 24144:24154 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.994490] binder: 24144:24154 Release 1 refcount change on invalid ref 0 ret -22 [ 846.994502] binder: 24144:24154 transaction failed 29189/-22, size 0-0 line 3119 [ 847.019113] binder: 24150:24156 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.019126] binder: 24150:24156 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.068535] binder: 24162:24170 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.068549] binder: 24162:24170 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.068978] binder: 24162:24170 Release 1 refcount change on invalid ref 0 ret -22 [ 847.068990] binder: 24162:24170 transaction failed 29189/-22, size 0-0 line 3119 [ 847.085981] binder: 24174:24177 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.085993] binder: 24174:24177 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.106726] binder: 24178:24183 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.106739] binder: 24178:24183 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.107046] binder: 24178:24183 Release 1 refcount change on invalid ref 0 ret -22 [ 847.107059] binder: 24178:24183 transaction failed 29189/-22, size 0-0 line 3119 [ 847.135682] binder: 24184:24188 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.135695] binder: 24184:24188 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.156838] binder: 24190:24197 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.156850] binder: 24190:24197 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.157789] binder: 24190:24197 Release 1 refcount change on invalid ref 0 ret -22 [ 847.157802] binder: 24190:24197 transaction failed 29189/-22, size 0-0 line 3119 [ 847.199588] binder: 24202:24207 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.199602] binder: 24202:24207 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.202370] binder: 24202:24207 Release 1 refcount change on invalid ref 0 ret -22 [ 847.202393] binder: 24202:24207 transaction failed 29189/-22, size 0-0 line 3119 [ 847.223521] binder: 24205:24209 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.223534] binder: 24205:24209 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.278696] binder: 24218:24227 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.278709] binder: 24218:24227 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.279523] binder: 24218:24227 Release 1 refcount change on invalid ref 0 ret -22 [ 847.279537] binder: 24218:24227 transaction failed 29189/-22, size 0-0 line 3119 [ 847.284169] binder: 24222:24228 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.284182] binder: 24222:24228 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.335589] binder: 24235:24243 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.335602] binder: 24235:24243 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.367387] binder: 24248:24251 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.367402] binder: 24248:24251 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.394675] binder: 24241:24250 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.394687] binder: 24241:24250 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.394944] binder: 24241:24250 Release 1 refcount change on invalid ref 0 ret -22 [ 847.394956] binder: 24241:24250 transaction failed 29189/-22, size 0-0 line 3119 [ 847.438292] binder: 24261:24266 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.438306] binder: 24261:24266 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.444239] binder: 24263:24269 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.444253] binder: 24263:24269 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.444705] binder: 24263:24269 Release 1 refcount change on invalid ref 0 ret -22 [ 847.444718] binder: 24263:24269 transaction failed 29189/-22, size 0-0 line 3119 [ 847.491114] binder: 24277:24281 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.491126] binder: 24277:24281 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.520396] binder: 24279:24289 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.520411] binder: 24279:24289 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.521171] binder: 24279:24289 Release 1 refcount change on invalid ref 0 ret -22 [ 847.521187] binder: 24279:24289 transaction failed 29189/-22, size 0-0 line 3119 [ 847.531971] binder: 24286:24292 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.531984] binder: 24286:24292 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.582685] binder: 24298:24306 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.582712] binder: 24298:24306 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.586506] binder: 24298:24306 Release 1 refcount change on invalid ref 0 ret -22 [ 847.586519] binder: 24298:24306 transaction failed 29189/-22, size 0-0 line 3119 [ 847.597528] binder: 24304:24309 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.597541] binder: 24304:24309 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.664406] binder: 24316:24324 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.664420] binder: 24316:24324 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.664937] binder: 24312:24325 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.664949] binder: 24312:24325 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.665937] binder: 24312:24325 Release 1 refcount change on invalid ref 0 ret -22 [ 847.665950] binder: 24312:24325 transaction failed 29189/-22, size 0-0 line 3119 [ 847.744690] binder: 24337:24343 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.744710] binder: 24337:24343 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.749371] binder: 24335:24344 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.749393] binder: 24335:24344 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.749728] binder: 24335:24344 Release 1 refcount change on invalid ref 0 ret -22 [ 847.749742] binder: 24335:24344 transaction failed 29189/-22, size 0-0 line 3119 [ 847.811998] binder: 24355:24359 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.812011] binder: 24355:24359 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.812125] binder: 24355:24359 Release 1 refcount change on invalid ref 0 ret -22 [ 847.812139] binder: 24355:24359 transaction failed 29189/-22, size 0-0 line 3119 [ 847.821851] binder: 24353:24362 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.821865] binder: 24353:24362 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.872979] binder: 24369:24375 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.872992] binder: 24369:24375 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.873337] binder: 24369:24375 Release 1 refcount change on invalid ref 0 ret -22 [ 847.873351] binder: 24369:24375 transaction failed 29189/-22, size 0-0 line 3119 [ 847.895712] binder: 24373:24380 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.895725] binder: 24373:24380 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.939727] binder: 24385:24389 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.939740] binder: 24385:24389 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.939862] binder: 24385:24389 Release 1 refcount change on invalid ref 0 ret -22 [ 847.939875] binder: 24385:24389 transaction failed 29189/-22, size 0-0 line 3119 [ 847.972504] binder: 24394:24399 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.972519] binder: 24394:24399 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.974986] binder: 24400:24403 Acquire 1 refcount change on invalid ref 0 ret -22 [ 847.974998] binder: 24400:24403 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.975552] binder: 24400:24403 Release 1 refcount change on invalid ref 0 ret -22 [ 847.975566] binder: 24400:24403 transaction failed 29189/-22, size 0-0 line 3119 [ 848.030782] binder: 24408:24418 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.030795] binder: 24408:24418 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.030906] binder: 24408:24418 Release 1 refcount change on invalid ref 0 ret -22 [ 848.030919] binder: 24408:24418 transaction failed 29189/-22, size 0-0 line 3119 [ 848.044451] binder: 24413:24420 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.044463] binder: 24413:24420 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.090565] binder: 24422:24427 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.090577] binder: 24422:24427 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.090683] binder: 24422:24427 Release 1 refcount change on invalid ref 0 ret -22 [ 848.090695] binder: 24422:24427 transaction failed 29189/-22, size 0-0 line 3119 [ 848.102287] binder: 24428:24435 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.102300] binder: 24428:24435 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.124505] binder: 24438:24440 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.124518] binder: 24438:24440 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.124619] binder: 24438:24440 Release 1 refcount change on invalid ref 0 ret -22 [ 848.124632] binder: 24438:24440 transaction failed 29189/-22, size 0-0 line 3119 [ 848.167470] binder: 24445:24449 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.167484] binder: 24445:24449 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.172357] binder: 24448:24450 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.172369] binder: 24448:24450 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.172658] binder: 24448:24450 Release 1 refcount change on invalid ref 0 ret -22 [ 848.172671] binder: 24448:24450 transaction failed 29189/-22, size 0-0 line 3119 [ 848.225146] binder: 24459:24468 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.225159] binder: 24459:24468 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.225832] binder: 24459:24468 Release 1 refcount change on invalid ref 0 ret -22 [ 848.225845] binder: 24459:24468 transaction failed 29189/-22, size 0-0 line 3119 [ 848.231970] binder: 24460:24466 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.231982] binder: 24460:24466 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.292663] binder: 24478:24485 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.292676] binder: 24478:24485 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.292867] binder: 24474:24483 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.292879] binder: 24474:24483 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.293151] binder: 24478:24485 Release 1 refcount change on invalid ref 0 ret -22 [ 848.293164] binder: 24478:24485 transaction failed 29189/-22, size 0-0 line 3119 [ 848.346171] binder: 24490:24496 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.346184] binder: 24490:24496 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.377007] binder: 24493:24501 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.377020] binder: 24493:24501 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.396224] binder: 24493:24501 Release 1 refcount change on invalid ref 0 ret -22 [ 848.396239] binder: 24493:24501 transaction failed 29189/-22, size 0-0 line 3119 [ 848.413449] binder: 24505:24512 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.413464] binder: 24505:24512 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.437937] binder: 24513:24518 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.437951] binder: 24513:24518 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.438080] binder: 24513:24518 Release 1 refcount change on invalid ref 0 ret -22 [ 848.438093] binder: 24513:24518 transaction failed 29189/-22, size 0-0 line 3119 [ 848.456080] binder: 24519:24523 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.456093] binder: 24519:24523 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.485784] binder: 24530:24533 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.485798] binder: 24530:24533 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.486404] binder: 24530:24533 Release 1 refcount change on invalid ref 0 ret -22 [ 848.486418] binder: 24530:24533 transaction failed 29189/-22, size 0-0 line 3119 [ 848.540116] binder: 24537:24542 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.540130] binder: 24537:24542 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.555305] binder: 24546:24549 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.555317] binder: 24546:24549 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.555427] binder: 24546:24549 Release 1 refcount change on invalid ref 0 ret -22 [ 848.555441] binder: 24546:24549 transaction failed 29189/-22, size 0-0 line 3119 [ 848.592857] binder: 24555:24559 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.592871] binder: 24555:24559 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.621996] binder: 24560:24565 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.622009] binder: 24560:24565 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.622167] binder: 24560:24565 Release 1 refcount change on invalid ref 0 ret -22 [ 848.622180] binder: 24560:24565 transaction failed 29189/-22, size 0-0 line 3119 [ 848.661679] binder: 24570:24573 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.661692] binder: 24570:24573 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.689498] binder: 24576:24587 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.689511] binder: 24576:24587 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.690152] binder: 24576:24587 Release 1 refcount change on invalid ref 0 ret -22 [ 848.690166] binder: 24576:24587 transaction failed 29189/-22, size 0-0 line 3119 [ 848.721550] binder: 24585:24589 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.721563] binder: 24585:24589 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.750506] binder: 24595:24601 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.750518] binder: 24595:24601 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.751267] binder: 24595:24601 Release 1 refcount change on invalid ref 0 ret -22 [ 848.751281] binder: 24595:24601 transaction failed 29189/-22, size 0-0 line 3119 [ 848.777465] binder: 24604:24607 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.777478] binder: 24604:24607 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.809889] binder: 24615:24619 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.809902] binder: 24615:24619 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.810015] binder: 24615:24619 Release 1 refcount change on invalid ref 0 ret -22 [ 848.810028] binder: 24615:24619 transaction failed 29189/-22, size 0-0 line 3119 [ 848.819207] binder: 24613:24620 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.819219] binder: 24613:24620 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.869105] binder: 24630:24632 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.869119] binder: 24630:24632 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.869328] binder: 24630:24632 Release 1 refcount change on invalid ref 0 ret -22 [ 848.869342] binder: 24630:24632 transaction failed 29189/-22, size 0-0 line 3119 [ 848.869630] binder: 24629:24633 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.869643] binder: 24629:24633 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.935204] binder: 24644:24648 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.935217] binder: 24644:24648 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.935386] binder: 24644:24648 Release 1 refcount change on invalid ref 0 ret -22 [ 848.935400] binder: 24644:24648 transaction failed 29189/-22, size 0-0 line 3119 [ 848.941061] binder: 24645:24654 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.941073] binder: 24645:24654 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.990591] binder: 24660:24664 Acquire 1 refcount change on invalid ref 0 ret -22 [ 848.990605] binder: 24660:24664 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.991535] binder: 24660:24664 Release 1 refcount change on invalid ref 0 ret -22 [ 848.991556] binder: 24660:24664 transaction failed 29189/-22, size 0-0 line 3119 [ 849.013316] binder: 24661:24673 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.013329] binder: 24661:24673 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.061100] binder: 24675:24686 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.061113] binder: 24675:24686 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.061224] binder: 24675:24686 Release 1 refcount change on invalid ref 0 ret -22 [ 849.061237] binder: 24675:24686 transaction failed 29189/-22, size 0-0 line 3119 [ 849.063619] binder: 24682:24687 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.063631] binder: 24682:24687 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.136172] binder: 24697:24705 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.136186] binder: 24697:24705 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.136298] binder: 24697:24705 Release 1 refcount change on invalid ref 0 ret -22 [ 849.136311] binder: 24697:24705 transaction failed 29189/-22, size 0-0 line 3119 [ 849.143949] binder: 24702:24708 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.143960] binder: 24702:24708 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.174956] binder: 24713:24717 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.174969] binder: 24713:24717 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.190948] binder: 24712:24715 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.190961] binder: 24712:24715 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.193925] binder: 24712:24715 Release 1 refcount change on invalid ref 0 ret -22 [ 849.193949] binder: 24712:24715 transaction failed 29189/-22, size 0-0 line 3119 [ 849.260321] binder: 24725:24736 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.260334] binder: 24725:24736 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.264655] binder: 24731:24738 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.264666] binder: 24731:24738 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.264792] binder: 24731:24738 Release 1 refcount change on invalid ref 0 ret -22 [ 849.264804] binder: 24731:24738 transaction failed 29189/-22, size 0-0 line 3119 [ 849.320036] binder: 24747:24752 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.320049] binder: 24747:24752 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.320167] binder: 24747:24752 Release 1 refcount change on invalid ref 0 ret -22 [ 849.320180] binder: 24747:24752 transaction failed 29189/-22, size 0-0 line 3119 [ 849.338065] binder: 24749:24753 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.338078] binder: 24749:24753 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.388931] binder: 24762:24765 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.388944] binder: 24762:24765 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.389057] binder: 24762:24765 Release 1 refcount change on invalid ref 0 ret -22 [ 849.389072] binder: 24762:24765 transaction failed 29189/-22, size 0-0 line 3119 [ 849.426255] binder: 24768:24776 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.426268] binder: 24768:24776 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.435848] binder: 24775:24783 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.435860] binder: 24775:24783 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.437110] binder: 24775:24783 Release 1 refcount change on invalid ref 0 ret -22 [ 849.437124] binder: 24775:24783 transaction failed 29189/-22, size 0-0 line 3119 [ 849.478565] binder: 24787:24789 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.478578] binder: 24787:24789 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.490314] binder: 24791:24795 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.490326] binder: 24791:24795 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.490436] binder: 24791:24795 Release 1 refcount change on invalid ref 0 ret -22 [ 849.490448] binder: 24791:24795 transaction failed 29189/-22, size 0-0 line 3119 [ 849.542643] binder: 24800:24805 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.542656] binder: 24800:24805 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.559294] binder: 24803:24810 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.559318] binder: 24803:24810 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.559945] binder: 24803:24810 Release 1 refcount change on invalid ref 0 ret -22 [ 849.559958] binder: 24803:24810 transaction failed 29189/-22, size 0-0 line 3119 [ 849.603898] binder: 24819:24824 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.603911] binder: 24819:24824 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.604027] binder: 24819:24824 Release 1 refcount change on invalid ref 0 ret -22 [ 849.604040] binder: 24819:24824 transaction failed 29189/-22, size 0-0 line 3119 [ 849.616050] binder: 24815:24821 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.616063] binder: 24815:24821 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.651093] binder: 24831:24837 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.651106] binder: 24831:24837 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.651836] binder: 24831:24837 Release 1 refcount change on invalid ref 0 ret -22 [ 849.651850] binder: 24831:24837 transaction failed 29189/-22, size 0-0 line 3119 [ 849.655769] binder: 24835:24838 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.655781] binder: 24835:24838 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.712820] binder: 24842:24853 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.712832] binder: 24842:24853 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.713449] binder: 24842:24853 Release 1 refcount change on invalid ref 0 ret -22 [ 849.713462] binder: 24842:24853 transaction failed 29189/-22, size 0-0 line 3119 [ 849.720831] binder: 24847:24857 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.720843] binder: 24847:24857 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.760586] binder: 24860:24865 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.760599] binder: 24860:24865 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.761208] binder: 24860:24865 Release 1 refcount change on invalid ref 0 ret -22 [ 849.761302] binder: 24860:24865 transaction failed 29189/-22, size 0-0 line 3119 [ 849.794009] binder: 24868:24871 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.794022] binder: 24868:24871 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.842934] binder: 24877:24882 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.842948] binder: 24877:24882 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.843059] binder: 24877:24882 Release 1 refcount change on invalid ref 0 ret -22 [ 849.843072] binder: 24877:24882 transaction failed 29189/-22, size 0-0 line 3119 [ 849.845228] binder: 24881:24889 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.845241] binder: 24881:24889 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.911762] binder: 24898:24902 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.911775] binder: 24898:24902 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.916007] binder: 24896:24903 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.916020] binder: 24896:24903 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.916163] binder: 24896:24903 Release 1 refcount change on invalid ref 0 ret -22 [ 849.916188] binder: 24896:24903 transaction failed 29189/-22, size 0-0 line 3119 [ 849.989473] binder: 24916:24925 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.989487] binder: 24916:24925 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.991366] binder: 24917:24926 Acquire 1 refcount change on invalid ref 0 ret -22 [ 849.991386] binder: 24917:24926 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.991506] binder: 24917:24926 Release 1 refcount change on invalid ref 0 ret -22 [ 849.991519] binder: 24917:24926 transaction failed 29189/-22, size 0-0 line 3119 [ 850.042981] binder: 24931:24940 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.042994] binder: 24931:24940 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.043191] binder: 24931:24940 Release 1 refcount change on invalid ref 0 ret -22 [ 850.043204] binder: 24931:24940 transaction failed 29189/-22, size 0-0 line 3119 [ 850.046038] binder: 24933:24941 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.046052] binder: 24933:24941 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.090903] binder: 24946:24950 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.090915] binder: 24946:24950 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.091093] binder: 24947:24951 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.091105] binder: 24947:24951 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.091553] binder: 24946:24950 Release 1 refcount change on invalid ref 0 ret -22 [ 850.091566] binder: 24946:24950 transaction failed 29189/-22, size 0-0 line 3119 [ 850.164104] binder: 24963:24969 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.164117] binder: 24963:24969 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.164478] binder: 24961:24970 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.164490] binder: 24961:24970 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.164615] binder: 24961:24970 Release 1 refcount change on invalid ref 0 ret -22 [ 850.164628] binder: 24961:24970 transaction failed 29189/-22, size 0-0 line 3119 [ 850.232391] binder: 24979:24984 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.232405] binder: 24979:24984 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.233834] binder: 24979:24984 Release 1 refcount change on invalid ref 0 ret -22 [ 850.233847] binder: 24979:24984 transaction failed 29189/-22, size 0-0 line 3119 [ 850.242616] binder: 24976:24986 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.242629] binder: 24976:24986 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.315483] binder: 25000:25003 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.315498] binder: 25000:25003 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.319357] binder: 24994:25001 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.319370] binder: 24994:25001 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.319515] binder: 24994:25001 Release 1 refcount change on invalid ref 0 ret -22 [ 850.319530] binder: 24994:25001 transaction failed 29189/-22, size 0-0 line 3119 [ 850.347338] binder: 25009:25014 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.347351] binder: 25009:25014 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.347461] binder: 25009:25014 Release 1 refcount change on invalid ref 0 ret -22 [ 850.347474] binder: 25009:25014 transaction failed 29189/-22, size 0-0 line 3119 [ 850.388930] binder: 25015:25018 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.388943] binder: 25015:25018 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.404305] binder: 25020:25028 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.404318] binder: 25020:25028 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.405086] binder: 25020:25028 Release 1 refcount change on invalid ref 0 ret -22 [ 850.405100] binder: 25020:25028 transaction failed 29189/-22, size 0-0 line 3119 [ 850.444826] binder: 25031:25036 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.444839] binder: 25031:25036 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.481813] binder: 25037:25044 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.481826] binder: 25037:25044 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.482728] binder: 25037:25044 Release 1 refcount change on invalid ref 0 ret -22 [ 850.482741] binder: 25037:25044 transaction failed 29189/-22, size 0-0 line 3119 [ 850.510547] binder: 25045:25051 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.510561] binder: 25045:25051 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.544965] binder: 25064:25066 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.544979] binder: 25064:25066 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.549640] binder: 25059:25065 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.549652] binder: 25059:25065 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.551868] binder: 25059:25065 Release 1 refcount change on invalid ref 0 ret -22 [ 850.551891] binder: 25059:25065 transaction failed 29189/-22, size 0-0 line 3119 [ 850.592007] binder: 25072:25076 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.592020] binder: 25072:25076 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.608418] binder: 25080:25082 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.608431] binder: 25080:25082 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.608567] binder: 25080:25082 Release 1 refcount change on invalid ref 0 ret -22 [ 850.608580] binder: 25080:25082 transaction failed 29189/-22, size 0-0 line 3119 [ 850.653432] binder: 25084:25090 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.653444] binder: 25084:25090 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.678414] binder: 25093:25099 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.678427] binder: 25093:25099 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.678557] binder: 25093:25099 Release 1 refcount change on invalid ref 0 ret -22 [ 850.678569] binder: 25093:25099 transaction failed 29189/-22, size 0-0 line 3119 [ 850.710563] binder: 25104:25107 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.710575] binder: 25104:25107 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.747078] binder: 25109:25116 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.747093] binder: 25109:25116 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.747210] binder: 25109:25116 Release 1 refcount change on invalid ref 0 ret -22 [ 850.747224] binder: 25109:25116 transaction failed 29189/-22, size 0-0 line 3119 [ 850.773086] binder: 25118:25123 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.773099] binder: 25118:25123 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.811956] binder: 25131:25136 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.811969] binder: 25131:25136 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.812413] binder: 25131:25136 Release 1 refcount change on invalid ref 0 ret -22 [ 850.812426] binder: 25131:25136 transaction failed 29189/-22, size 0-0 line 3119 [ 850.855150] binder: 25135:25144 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.855163] binder: 25135:25144 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.881186] binder: 25149:25153 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.881199] binder: 25149:25153 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.881328] binder: 25149:25153 Release 1 refcount change on invalid ref 0 ret -22 [ 850.881342] binder: 25149:25153 transaction failed 29189/-22, size 0-0 line 3119 [ 850.926760] binder: 25155:25163 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.926774] binder: 25155:25163 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.974476] binder: 25173:25176 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.974488] binder: 25173:25176 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.975441] binder: 25167:25170 Acquire 1 refcount change on invalid ref 0 ret -22 [ 850.975552] binder: 25167:25170 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.976314] binder: 25167:25170 Release 1 refcount change on invalid ref 0 ret -22 [ 850.976514] binder: 25167:25170 transaction failed 29189/-22, size 0-0 line 3119 [ 851.032329] binder: 25185:25190 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.032341] binder: 25185:25190 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.032466] binder: 25185:25190 Release 1 refcount change on invalid ref 0 ret -22 [ 851.032479] binder: 25185:25190 transaction failed 29189/-22, size 0-0 line 3119 [ 851.079524] binder: 25186:25195 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.079537] binder: 25186:25195 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.107031] binder: 25199:25209 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.107043] binder: 25199:25209 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.107171] binder: 25199:25209 Release 1 refcount change on invalid ref 0 ret -22 [ 851.107182] binder: 25199:25209 transaction failed 29189/-22, size 0-0 line 3119 [ 851.136081] binder: 25211:25215 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.136093] binder: 25211:25215 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.169917] binder: 25218:25222 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.169930] binder: 25218:25222 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.170062] binder: 25218:25222 Release 1 refcount change on invalid ref 0 ret -22 [ 851.170075] binder: 25218:25222 transaction failed 29189/-22, size 0-0 line 3119 [ 851.194179] binder: 25227:25231 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.194193] binder: 25227:25231 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.236672] binder: 25232:25238 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.236684] binder: 25232:25238 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.236818] binder: 25232:25238 Release 1 refcount change on invalid ref 0 ret -22 [ 851.236831] binder: 25232:25238 transaction failed 29189/-22, size 0-0 line 3119 [ 851.249304] binder: 25239:25244 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.249317] binder: 25239:25244 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.305548] binder: 25252:25261 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.305561] binder: 25252:25261 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.305672] binder: 25252:25261 Release 1 refcount change on invalid ref 0 ret -22 [ 851.305684] binder: 25252:25261 transaction failed 29189/-22, size 0-0 line 3119 [ 851.322232] binder: 25254:25264 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.322244] binder: 25254:25264 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.367928] binder: 25269:25272 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.367941] binder: 25269:25272 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.368057] binder: 25269:25272 Release 1 refcount change on invalid ref 0 ret -22 [ 851.368070] binder: 25269:25272 transaction failed 29189/-22, size 0-0 line 3119 [ 851.401087] binder: 25274:25283 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.401098] binder: 25274:25283 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.405694] binder: 25277:25287 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.405706] binder: 25277:25287 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.405824] binder: 25277:25287 Release 1 refcount change on invalid ref 0 ret -22 [ 851.405837] binder: 25277:25287 transaction failed 29189/-22, size 0-0 line 3119 [ 851.480929] binder: 25294:25304 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.480942] binder: 25294:25304 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.492065] binder: 25299:25306 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.492078] binder: 25299:25306 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.492189] binder: 25299:25306 Release 1 refcount change on invalid ref 0 ret -22 [ 851.492202] binder: 25299:25306 transaction failed 29189/-22, size 0-0 line 3119 [ 851.535882] binder: 25313:25319 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.535895] binder: 25313:25319 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.536028] binder: 25313:25319 Release 1 refcount change on invalid ref 0 ret -22 [ 851.536042] binder: 25313:25319 transaction failed 29189/-22, size 0-0 line 3119 [ 851.542147] binder: 25316:25322 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.542159] binder: 25316:25322 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.604990] binder: 25327:25335 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.605250] binder: 25327:25335 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.633824] binder: 25332:25337 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.633836] binder: 25332:25337 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.639869] binder: 25332:25337 Release 1 refcount change on invalid ref 0 ret -22 [ 851.639883] binder: 25332:25337 transaction failed 29189/-22, size 0-0 line 3119 [ 851.665161] binder: 25346:25352 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.665174] binder: 25346:25352 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.673928] binder: 25349:25354 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.673940] binder: 25349:25354 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.674050] binder: 25349:25354 Release 1 refcount change on invalid ref 0 ret -22 [ 851.674063] binder: 25349:25354 transaction failed 29189/-22, size 0-0 line 3119 [ 851.725006] binder: 25362:25364 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.725074] binder: 25362:25364 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.728454] binder: 25363:25366 Acquire 1 refcount change on invalid ref 0 ret -22 [ 851.728466] binder: 25363:25366 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 851.728806] binder: 25363:25366 Release 1 refcount change on invalid ref 0 ret -22 [ 851.728818] binder: 25363:25366 transaction failed 29189/-22, size 0-0 line 3119 [ 857.311222] binder: undelivered TRANSACTION_ERROR: 29189 [ 857.331057] binder: undelivered TRANSACTION_ERROR: 29189 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 857.337870] binder: 25376:25377 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 857.337891] binder: 25376:25377 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 857.338065] binder: 25374:25378 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 857.338075] binder: 25374:25378 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 857.338353] binder: 25376:25377 Release 1 refcount change on invalid ref 0 ret -22 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 857.338368] binder: 25376:25377 transaction failed 29189/-22, size 0-0 line 3119 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 857.383414] binder: 25381:25387 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 857.383427] binder: 25381:25387 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 857.405945] binder: 25388:25390 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 857.405958] binder: 25388:25390 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.406084] binder: 25388:25390 Release 1 refcount change on invalid ref 0 ret -22 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 857.406097] binder: 25388:25390 transaction failed 29189/-22, size 0-0 line 3119 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 857.453688] binder: 25399:25404 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 857.453701] binder: 25399:25404 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:30 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:30 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 857.466602] binder: 25403:25409 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:30 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 857.466617] binder: 25403:25409 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 857.466743] binder: 25403:25409 Release 1 refcount change on invalid ref 0 ret -22 [ 857.466756] binder: 25403:25409 transaction failed 29189/-22, size 0-0 line 3119 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 857.496327] binder: 25415:25418 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 857.496391] binder: 25415:25418 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 857.524325] binder: 25421:25426 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 857.524337] binder: 25421:25426 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.524459] binder: 25421:25426 Release 1 refcount change on invalid ref 0 ret -22 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 857.524472] binder: 25421:25426 transaction failed 29189/-22, size 0-0 line 3119 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 857.555056] binder: 25428:25435 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.555069] binder: 25428:25435 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 857.605598] binder: 25440:25448 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.605611] binder: 25440:25448 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 857.605834] binder: 25437:25446 Acquire 1 refcount change on invalid ref 0 ret -22 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) [ 857.605846] binder: 25437:25446 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) [ 857.605968] binder: 25437:25446 Release 1 refcount change on invalid ref 0 ret -22 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) [ 857.605989] binder: 25437:25446 transaction failed 29189/-22, size 0-0 line 3119 [ 857.661114] binder: 25456:25462 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.661127] binder: 25456:25462 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 857.661255] binder: 25456:25462 Release 1 refcount change on invalid ref 0 ret -22 [ 857.661268] binder: 25456:25462 transaction failed 29189/-22, size 0-0 line 3119 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) [ 857.662453] binder: 25452:25463 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.662466] binder: 25452:25463 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.734068] binder: 25469:25480 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.734081] binder: 25469:25480 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:31 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:31 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:31 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 857.759252] binder: 25471:25481 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.759265] binder: 25471:25481 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:20:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) 14:20:32 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 14:20:32 executing program 0: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000000)=@ethtool_sfeatures}) 14:20:32 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x1, 0x7ffb, 0xfffffffffffffffc}, 0x14) 14:20:32 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x5406, 0x71dff8) 14:20:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000280)=[@release, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 14:20:32 executing program 1: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 857.759438] binder: 25471:25481 Release 1 refcount change on invalid ref 0 ret -22 [ 857.759451] binder: 25471:25481 transaction failed 29189/-22, size 0-0 line 3119 [ 857.817543] binder: 25490:25498 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.817557] binder: 25490:25498 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.825156] binder: 25493:25502 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.825169] binder: 25493:25502 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.825298] binder: 25493:25502 Release 1 refcount change on invalid ref 0 ret -22 [ 857.825312] binder: 25493:25502 transaction failed 29189/-22, size 0-0 line 3119 [ 857.880985] binder: 25513:25517 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.880998] binder: 25513:25517 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.883211] binder: 25508:25514 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.883222] binder: 25508:25514 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.883332] binder: 25508:25514 Release 1 refcount change on invalid ref 0 ret -22 [ 857.883346] binder: 25508:25514 transaction failed 29189/-22, size 0-0 line 3119 [ 857.936821] binder: 25527:25529 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.936833] binder: 25527:25529 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.941304] binder: 25525:25532 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.941316] binder: 25525:25532 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 857.941452] binder: 25525:25532 Release 1 refcount change on invalid ref 0 ret -22 [ 857.941466] binder: 25525:25532 transaction failed 29189/-22, size 0-0 line 3119 [ 857.994391] binder: 25538:25544 Acquire 1 refcount change on invalid ref 0 ret -22 [ 857.994405] binder: 25538:25544 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.004319] binder: 25542:25548 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.004331] binder: 25542:25548 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.004457] binder: 25542:25548 Release 1 refcount change on invalid ref 0 ret -22 [ 858.004471] binder: 25542:25548 transaction failed 29189/-22, size 0-0 line 3119 [ 858.058947] binder: 25555:25561 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.058960] binder: 25555:25561 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.059579] binder: 25555:25561 Release 1 refcount change on invalid ref 0 ret -22 [ 858.059598] binder: 25555:25561 transaction failed 29189/-22, size 0-0 line 3119 [ 858.071875] binder: 25557:25564 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.071887] binder: 25557:25564 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.090891] binder: 25568:25571 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.090904] binder: 25568:25571 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.091016] binder: 25568:25571 Release 1 refcount change on invalid ref 0 ret -22 [ 858.091029] binder: 25568:25571 transaction failed 29189/-22, size 0-0 line 3119 [ 858.140211] binder: 25574:25583 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.140224] binder: 25574:25583 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.160093] binder: 25579:25585 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.160106] binder: 25579:25585 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.160234] binder: 25579:25585 Release 1 refcount change on invalid ref 0 ret -22 [ 858.160248] binder: 25579:25585 transaction failed 29189/-22, size 0-0 line 3119 [ 858.214508] binder: 25590:25597 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.214521] binder: 25590:25597 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.230365] binder: 25594:25603 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.230379] binder: 25594:25603 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.230503] binder: 25594:25603 Release 1 refcount change on invalid ref 0 ret -22 [ 858.230516] binder: 25594:25603 transaction failed 29189/-22, size 0-0 line 3119 [ 858.263602] binder: 25609:25612 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.263615] binder: 25609:25612 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.306474] binder: 25615:25623 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.306492] binder: 25615:25623 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.308729] binder: 25615:25623 Release 1 refcount change on invalid ref 0 ret -22 [ 858.308748] binder: 25615:25623 transaction failed 29189/-22, size 0-0 line 3119 [ 858.320319] binder: 25619:25625 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.320332] binder: 25619:25625 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.379064] binder: 25630:25640 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.379077] binder: 25630:25640 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.379203] binder: 25630:25640 Release 1 refcount change on invalid ref 0 ret -22 [ 858.379217] binder: 25630:25640 transaction failed 29189/-22, size 0-0 line 3119 [ 858.382130] binder: 25637:25641 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.382144] binder: 25637:25641 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.433724] binder: 25649:25654 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.433738] binder: 25649:25654 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.459691] binder: 25653:25658 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.459704] binder: 25653:25658 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.461467] binder: 25653:25658 Release 1 refcount change on invalid ref 0 ret -22 [ 858.461481] binder: 25653:25658 transaction failed 29189/-22, size 0-0 line 3119 [ 858.501090] binder: 25664:25669 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.501104] binder: 25664:25669 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.515130] binder: 25671:25675 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.515143] binder: 25671:25675 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.515241] binder: 25671:25675 Release 1 refcount change on invalid ref 0 ret -22 [ 858.515253] binder: 25671:25675 transaction failed 29189/-22, size 0-0 line 3119 [ 858.564335] binder: 25680:25686 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.564349] binder: 25680:25686 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.578640] binder: 25681:25689 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.578653] binder: 25681:25689 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.578997] binder: 25681:25689 Release 1 refcount change on invalid ref 0 ret -22 [ 858.579011] binder: 25681:25689 transaction failed 29189/-22, size 0-0 line 3119 [ 858.623750] binder: 25695:25700 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.623763] binder: 25695:25700 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.627013] binder: 25698:25703 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.627025] binder: 25698:25703 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.627134] binder: 25698:25703 Release 1 refcount change on invalid ref 0 ret -22 [ 858.627147] binder: 25698:25703 transaction failed 29189/-22, size 0-0 line 3119 [ 858.674467] binder: 25710:25717 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.674481] binder: 25710:25717 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.691934] binder: 25713:25718 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.691948] binder: 25713:25718 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.702210] binder: 25713:25718 Release 1 refcount change on invalid ref 0 ret -22 [ 858.702225] binder: 25713:25718 transaction failed 29189/-22, size 0-0 line 3119 [ 858.725607] binder: 25726:25728 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.725631] binder: 25726:25728 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.751254] binder: 25729:25734 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.751267] binder: 25729:25734 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.751377] binder: 25729:25734 Release 1 refcount change on invalid ref 0 ret -22 [ 858.751389] binder: 25729:25734 transaction failed 29189/-22, size 0-0 line 3119 [ 858.785402] binder: 25735:25739 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.785415] binder: 25735:25739 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.811552] binder: 25745:25749 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.811565] binder: 25745:25749 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.811689] binder: 25745:25749 Release 1 refcount change on invalid ref 0 ret -22 [ 858.811701] binder: 25745:25749 transaction failed 29189/-22, size 0-0 line 3119 [ 858.853563] binder: 25750:25759 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.853576] binder: 25750:25759 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.862619] binder: 25760:25762 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.862632] binder: 25760:25762 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.862751] binder: 25760:25762 Release 1 refcount change on invalid ref 0 ret -22 [ 858.862763] binder: 25760:25762 transaction failed 29189/-22, size 0-0 line 3119 [ 858.913366] binder: 25767:25772 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.913379] binder: 25767:25772 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.924004] binder: 25770:25779 Acquire 1 refcount change on invalid ref 0 ret -22 [ 858.924017] binder: 25770:25779 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 858.925015] binder: 25770:25779 Release 1 refcount change on invalid ref 0 ret -22 [ 858.925029] binder: 25770:25779 transaction failed 29189/-22, size 0-0 line 3119 [ 859.000098] binder: 25786:25789 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.000111] binder: 25786:25789 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.012569] binder: 25786:25789 Release 1 refcount change on invalid ref 0 ret -22 [ 859.012583] binder: 25786:25789 transaction failed 29189/-22, size 0-0 line 3119 [ 859.029176] binder: 25790:25795 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.029189] binder: 25790:25795 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.073553] binder: 25801:25805 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.073566] binder: 25801:25805 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.073867] binder: 25801:25805 Release 1 refcount change on invalid ref 0 ret -22 [ 859.073889] binder: 25801:25805 transaction failed 29189/-22, size 0-0 line 3119 [ 859.074011] binder: 25799:25804 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.074025] binder: 25799:25804 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.147888] binder: 25813:25817 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.147901] binder: 25813:25817 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.156290] binder: 25811:25820 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.156303] binder: 25811:25820 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.157716] binder: 25811:25820 Release 1 refcount change on invalid ref 0 ret -22 [ 859.157730] binder: 25811:25820 transaction failed 29189/-22, size 0-0 line 3119 [ 859.201439] binder: 25827:25830 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.201453] binder: 25827:25830 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.205998] binder: 25829:25834 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.206011] binder: 25829:25834 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.207105] binder: 25829:25834 Release 1 refcount change on invalid ref 0 ret -22 [ 859.207118] binder: 25829:25834 transaction failed 29189/-22, size 0-0 line 3119 [ 859.248930] binder: 25839:25843 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.248943] binder: 25839:25843 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.249069] binder: 25839:25843 Release 1 refcount change on invalid ref 0 ret -22 [ 859.249082] binder: 25839:25843 transaction failed 29189/-22, size 0-0 line 3119 [ 859.256731] binder: 25841:25845 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.256744] binder: 25841:25845 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.286517] binder: 25850:25854 Acquire 1 refcount change on invalid ref 0 ret -22 [ 859.286529] binder: 25850:25854 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 859.287593] binder: 25850:25854 Release 1 refcount change on invalid ref 0 ret -22 [ 859.287606] binder: 25850:25854 transaction failed 29189/-22, size 0-0 line 3119